Microsoft 365 accounts compromised at 79 organizations, no passwords needed

An attacker compromised Microsoft 365 accounts across 79 organizations by replaying stolen sign-in sessions, requiring no passwords. The campaign involved replaying these sessions and obtaining other tokens through device-code phishing and social engineering during logins. Attackers used this "token spraying" technique across many organizations using a limited set of IP addresses. Once access was gained, the attackers maintained persistence by wiping existing Multi-Factor Authentication (MFA) methods and registering new ones within three hours of the initial sign-in. The threat actors also manipulated email settings using inbox rules to hide incoming mail from victims.

The mechanism described highlights a critical failure point where session tokens, which follow successful Multi-Factor Authentication (MFA), are leveraged to bypass subsequent security layers. The ability for attackers to replay these tokens at scale, termed token spraying, demonstrates a structural vulnerability in how session lifecycle and token validation across distributed systems are managed. The response—wiping and resetting MFA methods immediately upon compromise—suggests an attempt to regain control but introduces potential friction points where legitimate access may be disrupted. Furthermore, the exploitation of email features for covert communication reveals that security controls must extend beyond authentication and focus on data exfiltration and operational secrecy within compromised environments. The persistence achieved by registering new authenticators shows that simply resetting credentials is insufficient if the underlying system logic allows for token-based re-establishment of access outside of direct password interaction. What systems govern the lifecycle integrity of session tokens when presented across disparate organizational boundaries? How resilient are perimeter defenses against attacks that exploit valid post-MFA credentials?