Zero Radar
← feed
HighSecurity incidentupdated 26 Oct 2026, 09:22 UTC

Microsoft 365 accounts hijacked by stolen sign-in sessions

Attackers tricked people into signing in through a fake relay that copied their login session. They then reused that copied session to get into email accounts without needing the password again.

Attacks reported (The Hacker News)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy The Hacker News, not officially confirmed yet
What to doCheck exposureCheck Microsoft 365 sign-in logs for suspicious sessions and revoke any tokens tied to them.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Phishing lureUser is sent a link to a fake sign-in
  2. 2AitM relayRelay sits between user and Microsoft
  3. 3User signs inCredentials and session pass through relay
  4. 4Token stolenSession token captured by attacker
  5. 5Token replayedAttacker reuses token to access mailbox
  6. ResultAttacker reads email at compromised accounts

What happened

An adversary-in-the-middle (AitM) relay captured Microsoft 365 sign-in sessions and replayed the stolen tokens to access mailboxes. Huntress observed the activity between July 14 and September 22, 2026.

Why it is dangerous: Attackers gained access to 97 accounts at 79 organizations, so email contents and mailboxes of those users were exposed. Any organization using Microsoft 365 with users who can be phished is at risk.

Are you affected?

You are affected if your organization uses Microsoft 365 and your users can be lured into signing in through an attacker-controlled relay.

Microsoft 365 accounts (specific versions not stated)

What to do

  1. Review Microsoft 365 sign-in logs for unusual token use or sign-ins from unexpected locations
  2. Revoke active sessions and tokens for any suspicious accounts and reset their passwords
  3. Enable phishing-resistant multi-factor authentication and conditional access policies
  4. Train users to check the sign-in page address before entering credentials

Timeline

  1. 26 Oct 2026, 08:35 UTC
    Publicly disclosed
  2. 26 Oct 2026, 08:35 UTC
    Reported by The Hacker News · The Hacker News
  3. 26 Oct 2026, 09:22 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-35a2887f
Disclosed
26 Oct 2026, 08:35 UTC
On Zero Radar
26 Oct 2026, 09:22 UTC (47 min after disclosure)
Last change
26 Oct 2026, 09:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Microsoft 365 accounts hijacked by stolen sign-in sessions · Zero Radar