Security researchers analyzed a Microsoft 365 phishing campaign utilizing adversary-in-the-middle relays to capture sessions and replay stolen tokens at scale, compromising dozens of corporate accounts and registering rogue Entra devices.
Cybersecurity firm Huntress announced that it detected this activity between July 14 and September 22, 2026. According to the data, the perpetrators managed to compromise a total of 97 accounts across 79 different organizations.
How attacks stole digital keys
Instead of trying to guess users' passwords, these attacks used fake login pages that were placed between the user and the real services. In this way, the attackers were able to steal login details and one-time passwords as users attempted to log in.
After obtaining the digital login keys, the perpetrators used them en masse from their own devices within minutes, making over 200.000 login attempts.
Permanent access and hidden rules in emails
Once they gained access to the accounts, the attackers took action to maintain control. At at least 19 organizations, existing authentication methods were removed and replaced with new applications they controlled themselves, often within less than three hours of the initial login. They also registered at least 48 fake computers in the companies’ registries to secure permanent access.
READ ALSO
Hidden file tried to trick developers' artificial intelligence
In some cases, the attackers created hidden rules in victims' inboxes to automatically delete emails related to salaries, payments, and bonuses. One of the compromised accounts marked all incoming messages as read, deleted them, and sent spam to hundreds of external recipients.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)