In a separate discovery, researchers at Enclave identified a vulnerability, CVE-2026-80097, that allowed malicious Android apps to steal authentication tokens by impersonating Microsoft Teams. The flaw required zero Android permissions and no password or MFA prompt to provide access to corporate mailboxes, files, and calendars. Microsoft patched the vulnerability in July, and the researchers stated there is no confirmed connection between the Android flaw and the active token-replay campaign.
Story
Hackers Bypass Microsoft 365 MFA to Hijack 97 Corporate Accounts
Cybersecurity18 hours ago
A cybersecurity campaign targeting Microsoft 365 used token-replay attacks to breach corporate environments by stealing session tokens after users completed their login process. Researchers at Huntress found that attackers captured these tokens through phishing and replayed them to bypass multi-factor authentication (MFA), resulting in 97 compromised accounts across 79 organizations. The campaign included 200,000+ failed login attempts and 497 successful sign-ins, with 48 rogue devices registered in Microsoft Entra environments and 19 organizations seeing victims' MFA methods removed and replaced. In one instance, a session was hijacked 12 minutes after the victim reached the MFA prompt.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.