Attackers are copying Microsoft 365 sign-ins after the password and code check, then using them to take over email at 79 organizations.
Hackers are stealing Microsoft 365 sign-ins after the victim has already typed the password and the security code. Security firm Huntress saw 97 accounts hijacked at 79 organizations between July 14 and September 22, 2026. The thieves then got into email without needing to pass the code check a second time.
Victims land on a fake sign-in page that sits between them and the real Microsoft page. It passes the password and code along, so the sign-in works. Microsoft then issues a token, a digital proof that you logged in. The attackers grab it and replay it from their own devices within minutes. Huntress calls this token spraying.
Huntress counted 497 successful sign-ins out of more than 200,000 login attempts. The stolen tokens came from fake sign-in pages, device-code phishing (tricking someone into approving a sign-in on a code screen) and social engineering during a real login.
A stolen token can expire or be cancelled. So the attackers added their own authenticator app to the account. At no fewer than 19 organizations, the victim's existing code methods were removed and a new one added within three hours. In one case on July 21, an app named "iPhone 13" was activated less than 51 minutes after the hijack.
They also registered at least 48 fake computers in victims' Microsoft directories. Huntress says a registered device can give attackers a longer-lasting way to request tokens, and it stays listed until someone deletes it.
The attackers also set up inbox rules with odd names such as a single dot, "sss" and "d". These rules deleted mail containing words like payroll, deposit and bonus, or moved it to obscure folders such as RSS Feeds. That kept the mailbox owner from seeing the messages.
In one mailbox, a rule marked every incoming message as read and deleted it. The account was then used to send spam to hundreds of outside recipients before Microsoft's Entra ID Protection rated it high risk.
The report covers organizations that use Microsoft 365 and Entra, Microsoft's system for work accounts and devices. Small businesses where staff handle payroll and deposits by email have the most reason to check. The material does not describe attacks on personal home accounts.
The alert box above lists the steps. Huntress adds that Conditional Access policies, which are rules an administrator sets to control how people may sign in, can close gaps that codes alone leave open. They should require a code check, or block the sign-in, for all users, all apps and all app types, with no exceptions.
The material does not say who is behind the campaign or how many more organizations may be hit. Huntress traced more than 200,000 failed login attempts to one range of internet addresses. It did not say whether the attacks have stopped.
A code check at sign-in is not enough on its own, so review sign-in methods, devices and inbox rules on Microsoft 365 accounts now.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
