The stolen session is only the starting point
Huntress disclosed October 22 a Microsoft 365 token-replay campaign it investigated at 79 organizations between July 14 and September 22. The company observed 497 successful sign-in events and more than 200,000 failed attempts. Its central finding is operational: an attacker who obtains a post-authentication session can use that foothold to establish additional ways back into the account. The report describes at least 48 rogue Entra devices, changes to multifactor authentication methods and mailbox rules designed to conceal messages. These are Huntress’s observed cases, not a measurement of all Microsoft 365 tenants.
Recovery must examine the account’s new state
Huntress recommends revoking sessions and resetting passwords, then inspecting registered devices, MFA methods, inbox rules and newly authorized applications. A password reset alone does not remove an attacker’s registered device or authenticator. Our analysis is that the recovery ticket should describe the expected state of the account after containment. That means identifying legitimate authentication methods and access relationships with the user, recording what was removed and checking that ordinary business activity can resume. Resetting a credential is one action within that process; it is not a complete account review.
Mail handling can hide the business consequence
The researchers describe an incident involving a payroll-related message sent to an outside accounting contact and rules that concealed relevant replies. For financial-services and professional-services teams, the practical issue is whether a compromised mailbox changed the information reaching a person who approves a payment or maintains a client record. The report does not establish that a fraudulent transfer succeeded. Our recommendation is to review affected business conversations with the responsible staff and verify consequential instructions through an independently established contact route. An investigation should distinguish attempted deception from a completed loss, and should preserve the message and rule evidence needed to make that distinction.
Measure access outcomes, not only attempt volume
Huntress warns that ranking response solely by failed-login volume can direct attention toward tenants whose controls are already blocking attempts. Its campaign analysis separates successful access from blocked activity. Security teams should make that separation visible in their own triage: which sessions succeeded, which account changes followed and which business resources were accessed. A blocked attempt still merits context, but its count should not eclipse evidence of an established session elsewhere. For an MSP, the customer handover should identify who reviewed authentication settings, who examined mailbox behavior and who approved restored access. Clear ownership helps prevent the technical password reset from being mistaken for completion while a business-impact review remains open.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
