INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Microsoft 365 Accounts Hijacked via Stolen Login Tokens

| 2026-10-27 07:55 LOW HIGH DATA BREACH
JSON
Executive Summary
AI-generated
Hackers compromised Microsoft 365 accounts at 79 organizations between July 14 and September 22, 2026, by reusing stolen login tokens. The attackers targeted authenticated sessions rather than relying on password guessing, resulting in a ten-week campaign that generated more than 200,000 failed login attempts across monitored customer environments. During this period, the hackers successfully hijacked Microsoft 365 accounts at 79 organizations using stolen login tokens, recording at least 497 successful sign-ins. The incident was reported by Cyber Security News and is attributed to Hackers Hijack Microsoft 365.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables 13 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 13 IoCs Create Free Account
urls 1 domains 1 ips 11
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎September 22, 2026
Threat actors used stolen login tokens to hijack Microsoft 365 accounts at 79 organizations.
infrastructure Microsoft 365
Similar to previously […] The post Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens appeared first on Cyber Security News .
victims 79 Organizations
Similar to previously […] The post Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens appeared first on Cyber Security News .
organisation Cyber Security News
Similar to previously […] The post Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens appeared first on Cyber Security News .
‎between July 14 and September 22, 2026
Threat actors reused stolen login tokens to compromise Microsoft 365 accounts at 79 organizations between July 14 and September 22, 2026.
infrastructure Microsoft 365
Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14 and September 22, 2026.
general_metric 365 Hijack Accounts
Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14 and September 22, 2026.
victims 79 Organizations
Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14 and September 22, 2026.
organisation Microsoft
Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14 and September 22, 2026.
general_metric 497 successful sign ins
Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14 and September 22, 2026.
‎2026/10/27
Hackers used stolen login tokens to hijack Microsoft 365 accounts at 79 organizations.
infrastructure Microsoft 365
Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens.
organisation Hackers Hijack Microsoft 365
Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens.
victims 79 Organizations
Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens.
Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14 and September 22, 2026.
Similar to previously […] The post Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens appeared first on Cyber Security News .
Metrics
victims
79
Organizations
Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens.
Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14 and September 22, 2026.
Similar to previously […] The post Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens appeared first on Cyber Security News .
Intelligence Sources
AlienVault OTX 2026-10-27