LazyNinja

🚨 BREAKING: Hackers are BYPASSING Microsoft 365 MFA, hijacking corporate accounts, and secretly replacing victims' authentication methods to maintain access. 97 accounts compromised across 79 organizations. In some cases, attackers took over sessions in just 12 MINUTES. And now, researchers have separately exposed a critical flaw in Microsoft Authenticator that allowed malicious apps to steal login tokens with ZERO permissions. Microsoft's authentication security is facing two serious threats, and one is already being exploited in the wild. Here's what's happening: 🔴 1. MICROSOFT 365 ACCOUNTS HIJACKED IN THE WILD Cybersecurity researchers at Huntress uncovered a widespread token-replay attack campaign targeting Microsoft 365. The numbers are alarming: → 200,000+ failed login attempts observed. → 497 successful sign-in events. → 97 compromised accounts across 79 organizations. → 48 rogue devices registered inside Microsoft Entra environments. → 19 organizations had victims' MFA methods removed and replaced. Attackers used sophisticated phishing techniques to capture legitimate authentication tokens AFTER victims completed MFA. They then replayed those tokens to access Microsoft 365 without another authentication challenge. But it gets worse. Once inside, attackers registered their OWN authenticator apps and devices to maintain persistent access. They also created hidden email rules to intercept or delete messages involving payroll, banking, and direct deposits. In one case, attackers hijacked a session just 12 MINUTES after the victim reached the MFA prompt and registered their own authenticator less than an hour later. Changing your password alone may NOT remove the attacker. 🔴 2. CRITICAL MICROSOFT AUTHENTICATOR TOKEN THEFT FLAW In a separate discovery, researchers at Enclave exposed CVE-2026-80097 (CVSS 8.6), a vulnerability allowing malicious Android apps to steal Microsoft authentication tokens. → ZERO Android permissions required. → No password required. → No additional MFA prompt. → Malicious apps could impersonate Microsoft Teams. → Stolen tokens could provide access to corporate email, files, calendars, and sensitive account functionality. The underlying flaw? Microsoft Authenticator trusted an application's claimed identity without properly verifying the actual caller. Microsoft has since patched this vulnerability. These are TWO separate security issues, with no confirmed connection between them. But they expose the same dangerous reality: 🚨 MFA ALONE IS NO LONGER ENOUGH TO STOP ATTACKERS WHO CAN STEAL OR REPLAY AUTHENTICATION TOKENS. And businesses relying entirely on MFA for protection may have a serious blind spot. 🛡️ IS YOUR BUSINESS EXPOSED? At Lucid Security, we're offering FREE security reviews to help businesses identify vulnerabilities, authentication weaknesses, and potential security gaps before attackers exploit them. Get your free security review: 🌐 lucidsecurity.si Sources: thehackernews.com/2026/10/mi… enclave.ai/blog/authmask-we-…