MFA is not a wall: how hackers hijack your session tokens

Nov 06, 2026

Who is Huntress?

Everything in this episode starts from research by Huntress, so first: who are they? Huntress is an American cybersecurity company (24/7 SOC). Their analysts review alerts daily for thousands of businesses without their own security team, usually through IT partners. That matters, because it determines what they see: not rare state-sponsored attacks, but the ordinary, persistent crime that targets businesses like yours. When such a party raises the alarm about a campaign against Microsoft 365 tenants, it is not a theoretical risk from a report, but something their customers actually experienced this summer.

What exactly happened?

Between mid-July and the end of September, the researchers tracked a campaign they call "token spraying", by analogy with password spraying. The attack starts at a fake login page acting as a man-in-the-middle between the user and Microsoft. The employee sees the real login page, types the password, gets the real MFA prompt on the phone and approves. Everything looks normal. But the relay keeps the session token that Microsoft issues after that successful sign-in. Whoever holds that token never has to pass MFA again: the system sees them as the legitimate user.

Then it gets industrialised. The stolen tokens were replayed in bulk from a single block of IP addresses at a German hosting provider that also serves criminals: more than 200,000 automated attempts led to 497 successful sign-ins at 79 organisations. In total, 97 accounts were taken over.

What happens next deserves your full attention. The attackers registered 48 fake devices in the victims' Entra directories, so they could keep requesting new tokens. At no fewer than 19 organisations, the victims' existing MFA methods were wiped and replaced by the attacker's own authenticator. In one case within 51 minutes of the sign-in. Finally, hidden rules were placed in mailboxes that silently redirected emails about pay, transfers and bonuses. One hijacked mailbox was used to send a payroll email to an external recipient: this is classic invoice fraud, no longer espionage.

Not new. But industrialised.

Let us be honest: token theft is not a 2026 invention. Fake pages that bypass the MFA step have existed for years, and if you have been reading our newsletter for a while, you have read about it here before. In November last year we wrote about passwordless working, and I quoted a podcast that rightly wondered why we were still typing passwords in 2025. That article is still online: dunetrails.be/en/passwordless-working-can-your-sme-start-today.

What is new is the scale and the speed. One operation, one IP block, everything automated. Where attackers previously took over accounts manually, it has now become assembly-line work. That changes the arithmetic: 79 affected organisations means 79 IT teams that did not see it happen.

Microsoft says so itself

Anyone who thinks this is a niche observation from a single vendor should read the Microsoft Digital Defense Report 2026, published on 1 October. Microsoft calls identity "the primary control plane" and explicitly warns that the AI hype must not distract attention from identity security. The report counted more than 145 million QR-phishing attacks in a single year, and the conclusion is the same as Huntress's: choose phishing-resistant authentication and passkeys, not yet another extra code.

What we see in practice

This is not theory for us. At one of our customers we are currently guiding the rollout of passkeys as the standard sign-in method, and since 1 September of this year passkeys are the default in Entra ID. In the CyFun audits we perform for Belgian organisations this is always one of the first things we check: who can register what, and who notices when it happens? At the 79 organisations in the research, the answer to that second question was always: nobody.

What can you do this week?

Four things, in order of urgency:

1. Put an alert on every registration of a new MFA method. At 19 organisations the attack was visible within three hours at exactly that point.
2. Review the list of registered methods and devices in Entra once per quarter. Remove what nobody recognises. The fake devices stayed in the directories until someone removed them manually.
3. Check whether your Conditional Access policy actually blocks token replay. According to Huntress this is entirely preventable with correctly configured policies.
4. And if it goes wrong: the order of your recovery determines everything. Revoke sessions, reset the password, and only then remove the attacker's registered devices and MFA methods. A password reset alone simply leaves the attacker's authenticator in place.