Microsoft 365 Token-Replay Campaign Hits 79 Organizations

Researchers at Huntress have described a Microsoft 365 campaign in which attackers did not guess passwords but instead captured and replayed session tokens. Between July 14 and September 22, 2026, they recorded 497 successful sign-ins across 79 organizations — against more than 200,000 failed attempts traced back to the 193.26.115[.]0/24 address range. Ultimately 97 accounts were compromised and 48 rogue Entra devices were registered.

How it works

A fake login page sits between the victim and legitimate Microsoft infrastructure in an adversary-in-the-middle (AitM) setup. It captures the entered credentials and MFA codes and relays them to the real server. The real prize is the access token Microsoft issues after sign-in: with it in hand, the attacker never needs to defeat MFA a second time. This "proof of login" is replayed from the attacker's own devices within minutes to drive automated requests against Microsoft 365 services.

The technique has been dubbed token spraying — by analogy with password spraying, since many stolen tokens are replayed at scale across multiple organizations.

Persistence and concealment

Once inside, the attackers added their own authenticator app to clear MFA challenges and survive an expired or revoked session. In at least 19 organizations the victim's existing MFA methods were removed and a new one registered within three hours of the first sign-in; in one case an app named "iPhone 13" went live less than 51 minutes after the session was hijacked. Fake devices in the Entra directory offered an even more durable way to request tokens.

The operators also planted hidden inbox rules with nondescript names like ".", "sss", "iT" and "........" that deleted or buried messages mentioning payroll, deposits and bonuses. One hijacked mailbox sent spam to hundreds of external recipients before Entra ID Protection flagged the account as high risk.

The trail

According to Huntress, the tokens came from several sources: AitM relays, device-code phishing, and social engineering. The earliest activity traces to a Romanian IP tied to the AsyncRAT trojan and to German hosting provider 1337 Services GmbH — itself linked to StarkRDP and rdp[.]sh, virtual-server rental services whose domains were seized in the January 2025 international operation Talent but soon resumed under new names.

Victims are advised to revoke sessions and reset passwords, audit Entra devices and MFA methods, look for unexpected inbox rules and new enterprise apps, and restrict device-code workflows with Conditional Access policies.

Source: The Hacker News