What happened
From July 14 to September 22 2026, attackers harvested session tokens via device‑code phishing and adversary‑in‑the‑middle relays, then replayed them from a single hosting provider’s IP block. They signed in to 497 Microsoft 365 accounts, inserted hidden inbox rules, wiped existing MFA methods, and registered rogue devices in Azure AD, all without ever needing a password.
Why it matters for trust and compliance
- The incident illustrates why continuous monitoring of token usage and strict MFA device management are essential control‑assurance practices that provide defensible evidence for audits.
- Continuous sign‑in monitoring can detect token‑replay anomalies and support audit evidence of authentication controls.
- Robust MFA lifecycle management and device inventory audits demonstrate due diligence for frameworks such as NIST CSF 2.0.
Who is affected
Enterprises using Microsoft 365 for email and collaboration Cloud‑based SaaS providers with Azure AD tenant management
Recommended actions
- Enforce Conditional Access policies that require MFA for every session and block token reuse.
- Deploy real‑time sign‑in risk analytics to flag anomalous IP ranges and token replay.
- Audit and purge unknown devices from Azure AD regularly.
- Restrict creation of inbox rules to privileged accounts only.
- Run targeted security‑awareness training on device‑code phishing and token theft.