- Published
- Source
- Help Net Security
- Filed under
- Microsoft, Attacks
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. The researchers tracked the campaign between July 14 and September 22, 2026, counting 497 successful sign-ins and more than 200,000 failed login attempts. The stolen sessions were replayed from servers at 1337 Services GmbH, a hosting provider incorporated … More →…
Practical steps for any organisation
- Patch quickly, starting with anything facing the internet.
- Use multi-factor authentication everywhere it is offered.
- Keep tested, offline backups – and a plan for the day you need them.
More helpNCSC: 10 Steps to Cyber Security (opens in a new tab)NCSC: incident management (opens in a new tab)
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Account Manipulation
Persistence, Privilege EscalationWhat a defender checks
- Audit new inbox and forwarding rules, especially ones that hide or forward mail.
- Review OAuth app consents and credentials added to apps.
- Alert on new privileged role assignments.
Build the skillBlue Team Analyst · Identity & Access Monitoring
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Microsoft SC-200 exam training
Defender and Sentinel in the headlines? That's the SC-200 toolkit.
Tutor-led SC-200 preparation: running security operations in Microsoft Sentinel and Defender XDR, responding to incidents across identity, endpoint, email and cloud, and threat hunting with KQL.
- Microsoft Sentinel and Defender XDR
- Incident response across Microsoft 365
- Threat hunting with KQL
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
