Microsoft 365 Token Replay Attack Compromises 79 Organizations
An attacker replayed stolen Microsoft 365 tokens to breach 79 organizations between July 14 and September 22, 2026. The campaign involved 497 successful sign-ins and more than 200,000 failed attempts, all executed without ever using a password.
Attack Path: From AiTM to Token Replay
The attacker first lured victims to fake sign-in pages that relayed the genuine Microsoft login and MFA prompts through an adversary-in-the-middle (AiTM) relay. Once the victim authenticated, the relay captured the session token issued by Microsoft after MFA completion. Because the token is generated post-MFA, the attacker could reuse it without re-authenticating.
Additional tokens were harvested via device-code phishing, where users entered a code on Microsoft’s legitimate page, and through social engineering during ordinary logins. The attacker then replayed these tokens in bulk from a single block of IP addresses, a technique the researchers term token spraying.
Source Infrastructure and Timing
Stolen sessions were replayed from servers operated by 1337 Services GmbH, a Hamburg-based hosting provider. Microsoft Entra ID Protection flagged several of these addresses. The attacker moved between six IP blocks in the 193.26.115.0/24 range over four phases, with gaps of one to two weeks. Blocking any one block would have stopped only a single phase.
The first hijacked session appeared from a 1337 Services address 12 minutes after the victim reached the MFA prompt on July 21; by September 22 the gap had shrunk to four minutes.
Persistence: Rogue Devices and MFA Replacement
After gaining access, the attacker registered at least 48 rogue computers in victim Microsoft Entra directories. Each device was named DESKTOP- followed by eight hexadecimal characters. Devices remain in the directory until an administrator deletes them.
In 19 organizations, the attacker wiped existing MFA methods and registered a new method within three hours of the initial sign-in. In one July 21 case, an authenticator app labeled “iPhone 13” was activated less than an hour after the session was hijacked. This app allowed the attacker to complete MFA for subsequent sign-ins, and the access survived a password reset unless the device was audited and removed.
Email Manipulation: Hidden Inbox Rules
The attacker used inbox rules to delete or hide mail from owners. Rules named “.”, “sss”, and “iT” moved incoming mail to folders such as RSS Feeds and Conversation History or marked it as read. In one instance, the attacker sent a payroll-related email to an external accountant, then created a rule to hide all mail from that accountant five minutes later.
Conditional Access and Blocking Efforts
On September 11, the attacker switched to a new address and ran an automated program that reused captured tokens. Over four days, it completed hundreds of successful sign-ins at nearly 30 organizations. The same address was blocked 1,052 times, all from four organizations whose Conditional Access policies refused the sign-ins. These policies can require MFA or block access outright, filling gaps that MFA alone cannot close.
Mitigation Guidance
Huntress has published mitigation steps and indicators of compromise on its blog. Key actions for administrators include:
- Block 1337 Services IP ranges: Monitor and block the 193.26.115.0/24 block and any new ranges associated with the provider.
- Audit device registrations: Search for DESKTOP-xxxxxx devices and remove any that are not recognized.
- Enforce Conditional Access: Require MFA for all sign-ins and block access from unknown IP ranges.
- Inspect inbox rules: Review and delete any rules that delete, hide, or redirect mail.
- Monitor sign-in patterns: Look for rapid token replay from a single IP block and investigate anomalous sign-in times.
What to Watch Next
The campaign shows that session tokens can be abused at scale when attackers replay them quickly. Organizations should consider tightening token lifetimes, implementing stricter device-management policies, and ensuring that Conditional Access rules are comprehensive. The use of AiTM relays and device-code phishing indicates that attackers are refining social-engineering techniques to bypass MFA. Continuous monitoring of sign-in logs and device inventories remains essential.
For further technical context, see the Zero-Day Vulnerability & CVE Exploit Matrix.
Related coverage
- AI Insider Threat: Enterprise AI Agents Slip Through Visibility Gaps
- Email bombing uses legitimate sign-ups to obscure fraud alerts