Hackers target Microsoft 365 accounts in global email compromise campaign

Cybersecurity researchers at Huntress uncovered a business email compromise campaign targeting Microsoft 365 environments worldwide, InfoSecurity Magazine and Help Net Security reported. The campaign relied on fake sign in pages, device code phishing, stolen session tokens, and social engineering to gain unauthorized access to corporate networks. [1][2]

According to Help Net Security, an attacker spent ten weeks replaying stolen Microsoft 365 sign in sessions to bypass multi factor authentication. The attacker broke into email accounts across 79 organizations between July 14 and September 22, 2026, recording 497 successful sign ins and over 200,000 failed login attempts. Help Net Security added that the attacker created hidden inbox rules to prevent victims from viewing portions of their own email. [2]

InfoSecurity Magazine noted that Huntress published its findings in a blog post on October 22, 2026, reporting that the operation made hundreds of thousands of access attempts to set up further business email compromise attacks. The stolen session tokens were replayed from server infrastructure during the ten week period, according to Help Net Security. [1][2]

In separate Microsoft 365 targeting, CSO Online and CyberSecurityNews reported that Microsoft observed a China state aligned group designated Storm-0940 using credentials stolen from a ConnectWise cloud backup breach. Microsoft said the group used an open source agentic artificial intelligence framework called ARTEX to automate cloud intrusions across more than 2,250 Microsoft 365 tenants. [3][4]