Hackers Abuse Compromised Outlook Accounts to Steal MFA-Protected Microsoft 365 Sessions

Attackers are quietly turning trusted Microsoft Outlook mailboxes into launchpads for stealing multi factor authenticated Microsoft 365 sessions, even when users think they are protected. Adversary in the middle phishing has evolved into a reliable tool for hijacking live cloud sessions that organizations depend on for daily work. The activity surfaced in May 2026, when a single phishing email sent to a small group of employees triggered a wider security incident across multiple organizations. Once the first accounts were compromised, the attackers reused those Outlook mailboxes to resend the same procurement themed lures deeper into the victim networks and out to external partners. Analysts from Infoblox traced that email back to a…