Between mid-July and late September, attackers replayed stolen Microsoft 365 sessions into 97 mailboxes across 79 organizations. Huntress counted 497 successful sign-ins. No brute-force spray showed up in the logs. The password never had to be right a second time. For cybersecurity teams that still treat MFA as the finish line, that’s the bill.

Mailbox control is the downtime. Hidden inbox rules bury vendor invoices. Password-reset mail for your IdP, your bank portal, and your VPN all arrive where the attacker already sits. Legal holds get forwarded off-tenant while the help desk is still asking the user to reboot. You’ll run incident response for weeks against a theft that registered as a successful login.

The same standing-token problem showed up in source control. Stolen GitHub tokens planted workflows that printed private repository secrets into Actions logs, then wiped the runs. Different cloud. Same design. You signed in once. The bearer token kept the door open.

Stolen Sessions Make Your Cybersecurity Stack Optional

Adversary-in-the-middle kits sit between a user and the real Microsoft sign-in page. The person finishes MFA on a site that looks right. The kit copies the session tokens and walks them into the real tenant. Threat detection sees a successful sign-in. The client is close enough to normal. Mail access looks like Tuesday.

A firewall at the office edge doesn’t see this. Neither does most threat-protection gear watching inbound exploits. The replay uses a valid cloud session. A copied cookie and a living refresh token are enough. The API believes the holder.

Conditional Access that only asks whether MFA was satisfied already got a yes during the phish. Bind sessions to compliant devices. Shorten sign-in frequency. Turn on continuous access evaluation so a revoked user dies in minutes, not at the next refresh window. If any browser holding the cookie is treated as the employee, you handed the attacker a badge.

Password-length rules and lockout policy are still worth the ticket. They don’t touch a token minted after MFA succeeded. Defense in depth that ends at the login form is one gate and a screenshot.

Huntress recorded 497 successful Microsoft 365 sign-ins across 97 accounts at 79 organizations between July 14 and September 22, 2026.

Huntress watched a two-month harvest. People typed a password into the wrong box once. If your playbook still opens with a password reset and a closed ticket, you haven’t contained anything. The mailbox stays live until you revoke the session family, dump refresh tokens, and inspect inbox rules and OAuth consents created in the same hour.

Most SOC dashboards still celebrate a drop in failed logons. Replay never fails. The sign-in is successful by design. If your detections key off error codes, impossible travel without a session-family view, or raw password sprays, this campaign will grade out as healthy users doing mail. You need alerts on new forwarding, novel refresh-token use from a new ASN, and workflow files appearing where no pull request exists.

GitHub Tokens Turned CI Logs Into a Drop Box

Wiz tracked an automated campaign, Gheist, that uses stolen GitHub tokens to drop a workflow into a repository, print the repo’s secrets into GitHub Actions logs, download those logs, and delete the runs. It succeeded against private repositories and GitHub Enterprise. The pipeline did the theft.

Nobody needed a second phish in the moment of the dump. A leaked personal access token, a stolen SSO cookie, or a leftover credential from a laptop image is enough standing access to edit automation. The workflow runs as the project. Secrets that should never hit a log get written there because the attacker asked the platform to echo them.

GitHub ships safeguards meant to pause some suspicious workflow activity. Don’t treat that pause as containment. Tokens that already belong to a collaborator look like normal automation. The job finishes. The attacker pulls the log with the same API your developers use to debug a failed build. Then the run vanishes from the default UI.

Call it what it is: a cyber security failure in the identity layer of the build system. Rotate the human password and leave the PAT in place, and you rotated the wrong secret. Keep Actions logs only in GitHub, and the person who deleted the run also deleted your evidence. Mailbox tokens and CI tokens are the same class of bearer credential. Both outlive the theft. Both keep your failed-login charts looking healthy while the data leaves.

Kill the Token or the Attacker Keeps the Keys

Password reset is a user-recovery step. Session kill is containment. You need both, and you need the session kill first, on Microsoft 365 and on GitHub.

Do these immediately when a replay or leaked developer token is even suspected:

• Revoke refresh tokens and sign the identity out of every session. A password change that leaves cookies alive is a gift.
• Hunt mailbox forwarding, hidden inbox rules, and new OAuth grants in a one-hour window around each successful replay.
• Inventory GitHub PATs, fine-grained tokens, SSH keys, and Actions secrets the stolen identity could read, then rotate them in one pass.
• Copy Actions audit events and run logs to storage the attacker can’t delete from the GitHub UI.
• Disable or restrict workflow edits on default branches until you know which repos the token touched.

Then change the defaults so the next theft dies younger. Security hardening that never includes token lifetime is unfinished work. Enforce phishing-resistant MFA for admins and anyone with mailbox or repo admin rights. Shorten token lifetimes and sign-in frequency. Require compliant devices for cloud mail. Turn on continuous access evaluation. On GitHub, prefer expiring fine-grained tokens over classic PATs, deny workflow permissions that can read all secrets unless the job needs them, and alert when a workflow file changes on the default branch or when a secret-shaped string hits a log.

Put one drill on the incident response calendar: valid session, hostile actor. Who can revoke Entra refresh tokens at 2 a.m. without opening a vendor ticket? Who can list GitHub PATs for a leaver who still has a fine-grained token in a personal account? If the answer is “we’d file a change,” you’ll watch replay continue while the ticket sits.

You can’t brute-force-proof your way out of a copied session. You can make stolen tokens expensive, short-lived, and noisy when they move. That’s the work.

Sources

• Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
• Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs