Microsoft 365 Token-Replay Attacks Hit 79 Organizations, 97 Accounts Compromised

Attack Overview

Huntress researchers observed a Microsoft 365 campaign between July 14 and September 22, 2026, that used adversary-in-the-middle relays to capture sign-in sessions and replay stolen tokens. The attack, dubbed token spraying, involved replaying many stolen tokens at scale across several organizations. Researchers recorded 497 successful sign-in events across victim organizations from over 200,000 login attempts, ultimately compromising 97 accounts.

Token Replay and MFA Bypass

The AitM login page sat between victims and legitimate Microsoft infrastructure, capturing entered credentials and MFA codes, then relaying the information to the real login page. The goal was to collect the access token issued by Microsoft following sign-in, so attackers did not have to bypass MFA a second time. The “proof of login” token was subsequently replayed from attacker devices within minutes to conduct automated sign-in attempts against Microsoft 365 services.

Persistence via Devices and Authenticator Apps

Attackers added rogue Entra devices and new authenticator apps as persistence mechanisms. In at least 19 organizations, existing MFA methods were removed and new ones registered within three hours of the first sign-in. On July 21, 2026, a new authenticator app named “iPhone 13” was activated less than 51 minutes after the session was hijacked. At least 48 fake computers were registered in victim directories, providing a durable way to request tokens beyond the stolen session alone.

Email Rule Abuse Attribution and Recommendations

The campaign established hidden inbox rules with names such as . sss ss iT ,., ........ s and d to delete or move emails referencing payroll deposit and bonus. One compromised mailbox was used to send outbound spam to hundreds of external recipients after the rules marked all incoming messages as read and deleted them. Microsoft Entra ID Protection rated the affected account high risk. Tokens originated from several sources: AitM relays behind fake sign-in pages, device-code phishing, and social engineering during legitimate logins. The campaign was first observed from a Romanian IP address, 193.26.115.221, which VirusTotal links to the AsyncRAT remote access trojan; the address is associated with a German hosting provider named 1337 Services GmbH. GreyNoise lists 29 IP addresses from that provider, 10 flagged malicious and five suspicious; the provider itself is linked to StarkRDP and rdp.sh. The domains linked to both were taken down in January 2025 as part of the international law enforcement operation Talent, alongside Nulled, Cracked and Sellix. StarkRDP denies involvement, saying only its website server and domain were seized. Organizations that suspect a token replay compromise are advised to revoke sessions and reset passwords, audit Entra devices, review MFA methods, check for unexpected inbox rules or new enterprise applications, and restrict device-code workflow with Conditional Access policies. Conditional Access Policies can help fill some of the security gaps that MFA cannot, as long as they are appropriately implemented, and should require MFA, or block, for all users, all cloud apps and all client app types unconditionally.

Sources: The Hacker News