Token-spraying campaign replays stolen Microsoft 365 sessions to bypass MFA and passwords

Security firm Huntress reported on October 22, 2026 a campaign in which attackers stole session tokens after victims completed a legitimate login and MFA challenge. The attackers then replayed these tokens from their own machines against Microsoft 365, so the stolen sessions did not require passwords or fresh MFA. Roughly 200,000 sign-in attempts were made, and 497 of them succeeded. The activity leaves few of the usual warning signs, such as phishing pages or suspicious geographic sign-ins. Huntress recommended checking identity logs for three signals that do not require access to token values.