MFA was on, and it didn't matter. Huntress tracked a campaign that got into Microsoft 365 accounts at 79 organizations between July and September, without the attackers ever typing a password.
The trick: a proxy sat between the victim and Microsoft's real login page. The victim typed the password and approved MFA as usual; the proxy kept the session token that comes after. Others were phished with device-code prompts. Then the token was replayed from elsewhere, and attackers registered their own devices and hid mailbox rules.
MFA protects the login, not the session after it. What helps:
- phishing-resistant MFA (passkeys, FIDO2 keys): it won't sign for the wrong domain
- block device-code flow if you don't use it
- watch for new devices and new inbox rules
https://www.huntress.com/blog/token-replay-spray
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-24 21:40:52 UTC
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-24 21:40:52 UTCEvent JSON
{
"id": "0023725f5baf53406e48e9a2b9df52cc5131ec231f1c4de53c41a71790d79c97",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1792878052,
"kind": 1,
"tags": [],
"content": "MFA was on, and it didn't matter. Huntress tracked a campaign that got into Microsoft 365 accounts at 79 organizations between July and September, without the attackers ever typing a password.\n\nThe trick: a proxy sat between the victim and Microsoft's real login page. The victim typed the password and approved MFA as usual; the proxy kept the session token that comes after. Others were phished with device-code prompts. Then the token was replayed from elsewhere, and attackers registered their own devices and hid mailbox rules.\n\nMFA protects the login, not the session after it. What helps:\n- phishing-resistant MFA (passkeys, FIDO2 keys): it won't sign for the wrong domain\n- block device-code flow if you don't use it\n- watch for new devices and new inbox rules\n\nhttps://www.huntress.com/blog/token-replay-spray",
"sig": "c8e8d20ac1fd00ea2458695e8e7a027b67278a9cb96452146940680ba64201f4ec3c2896a6a1e4d89855b91aee4c9f1295af9be1273b6cd75c77d150cbac0cb9"
}