Hackers Are Walking Past MFA to Hijack Microsoft 365 Accounts
Multi-factor authentication is not the finish line it used to be. A campaign that ran from July to September 2026 broke into Microsoft 365 accounts at 79 organisations without cracking a single password or triggering an MFA prompt.
Security firm Huntress tracked the operation, which it calls a "token spray and replay" campaign. The trick is simple and nasty. Victims log in through a fake sign-in page that quietly passes their real username, password and MFA code to Microsoft, then pockets the session token Microsoft hands back. That token is proof you already passed MFA, so the attacker replays it from their own server, sometimes within four minutes, and walks straight in. No second code required.
Why this matters for Australian businesses
Nearly every Australian small business runs on Microsoft 365, and this campaign went straight for the money. Once inside, the attackers registered their own authenticator apps, added rogue devices so they kept access even after a password reset, and set hidden inbox rules (named things like '.' or 'sss') to bury replies from accountants. In at least one case they emailed a payroll change to an external accountant and hid the whole conversation. This is business email compromise with the front door left open.
"In the Australian SMB environments we manage, the gap is almost always the same. MFA is switched on, but Conditional Access is not enforced and older sign-in flows like device code are left wide open. Turning MFA on is step one, not the whole job."
All IT ServicesWhat to do this week
- Enforce Conditional Access. Require MFA or block for all users, all cloud apps and all client types, not just "when it looks risky".
- Revoke sessions, do not just reset passwords. A reset on its own leaves stolen tokens, rogue devices and attacker MFA methods in place.
- Audit Entra devices and MFA methods. Look for unfamiliar 'DESKTOP-' devices and authenticators cleared and re-registered within minutes.
- Check mailbox rules. Hunt for oddly named rules that delete or move mail mentioning payroll, invoice or bank.
- Restrict device-code sign-in with a Conditional Access authentication-flow policy.
Microsoft 365 accounts compromised at 79 organizations, no passwords needed, Help Net Security
Frequently Asked Questions
We have MFA turned on. Are we still at risk?
Yes. This attack steals the session token that Microsoft issues after you pass MFA, so it never needs your code. MFA is essential, but it needs Conditional Access and session controls behind it to actually stop an intruder.
We reset the password on a suspicious account. Is that enough?
No. A password reset does not revoke active tokens, which can stay valid for around 90 minutes, and it does not remove rogue devices or authenticator apps the attacker registered. You need to revoke the account's sessions and audit its devices and MFA methods as well.
How would we know if we have been compromised?
Look for sign-ins from unfamiliar hosting IP addresses, new 'DESKTOP-' devices in Microsoft Entra, authenticator methods that were wiped and re-registered within minutes, and odd inbox rules with names like '.' or 'sss' that quietly delete or move email about payroll, invoices or banking.
What is the single most important fix?
Enforce Conditional Access across all users, all cloud apps and all client types, and restrict legacy and device-code sign-in flows. That closes the gap this campaign relied on.
Is Your Microsoft 365 Actually Locked Down?
We will review your Conditional Access, MFA and sign-in policies and close the gaps attackers are using, before they cost you a payroll run.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →