Multi-factor authentication gets treated as the end of the story. Huntress telemetry published this week argues it is closer to the beginning, after one operator spent ten weeks replaying stolen Microsoft 365 sessions from a handful of German hosting addresses and reached mailboxes at 79 organizations.
The campaign ran from July 14 to September 22, 2026. During it, that actor recorded 497 successful sign-ins against more than 200,000 failures, working from session cookies lifted through adversary-in-the-middle relays, device-code lures and plain conversation.
Why the password never mattered
A session token is issued after the MFA prompt clears, so whoever holds it walks in behind the check. Researchers coined the term token spraying for the pattern: the volume tactic of password spraying, aimed at stolen sessions rather than guesses.
Speed is the alarming part. In one July 21 intrusion, the hijacked session went live 12 minutes after the MFA prompt appeared. By September 22 that lag had fallen to four minutes.
Persistence hidden in plain sight
Investigators found no fewer than 48 rogue computers sitting in victims’ Entra directories, each carrying a DESKTOP- name plus eight hex characters. Within three hours of the first hostile sign-in, 19 organizations had the victim’s MFA methods erased and a fresh authenticator enrolled, a route back in that outlives a password reset.
Inbox rules named “.”, “sss” and “iT” quietly deleted or hid mail. One mailbox carried a rule catching anything mentioning payroll, direct deposit, bank or bonus, then a second hiding the accountant’s replies.
What actually stopped it
One address drew 1,052 blocks, all from four organizations running Conditional Access policies. The attacker cycled six addresses across four phases, so a single block would have ended one phase at most. Audit registered devices and authenticator enrollments, not just sign-ins.
