Between mid-July and late September 2026, researchers uncovered a widespread campaign that exploited stolen Microsoft 365 sign-in tokens to break into email accounts across dozens of organizations. Instead of brute-forcing credentials, attackers captured session tokens via adversary-in-the-middle (AitM) relays and other means, then replayed those tokens from their own infrastructure to authenticate as victims. The technique allowed an efficient, MFA‑circumventing path into mailboxes and Microsoft directories — with persistence and evasive inbox manipulation that prolonged the impact.
How the attack worked
Huntress observed the activity from July 14 to September 22, 2026. Attackers used AitM login pages that sit between victims and Microsoft’s real sign-in flow to capture entered credentials and MFA codes. Rather than using stolen credentials directly, the adversaries collected the access token issued after a successful sign-in — the “proof of login” — and replayed it from their own devices within minutes to authenticate against Microsoft 365 services. Because the workflow relied on replaying valid session tokens, attackers could succeed without redoing MFA for each attempt.
Huntress and the researchers labeled this automated, large-scale replaying of tokens “token spraying,” drawing an analogy to password‑spraying techniques: many token replays across many accounts and organizations.
Scale and impact observed
Across the campaign window Huntress detected more than 200,000 failed login attempts and traced 497 successful Microsoft 365 sign-in events across victim organizations. Those signs ultimately led to the compromise of 97 accounts at 79 organizations, and the registration of 48 rogue devices in Microsoft Entra directories. The attackers leveraged stolen sessions at scale to achieve footholds and then automated follow‑on actions once access was gained.
Persistence techniques and mailbox manipulation
After gaining access, attackers often pursued persistence so they could continue to access accounts even if a stolen token expired or was revoked. Tactics included adding an authenticator app to the victim’s account and registering fake or “rogue” Entra devices in the organization’s directory. Huntress reported that in at least 19 organizations the victims’ existing MFA methods were removed and a new method was registered within three hours of first sign-in; in one observed case an authenticator labeled “iPhone 13” was activated less than 51 minutes after the session was hijacked.
Attackers also created hidden inbox rules with innocuous or obfuscated names (examples observed include “.,” “sss,” “iT,” “,.,,” “……..,” “s,” and “d”) to delete or reroute messages. Those rules targeted payroll, deposit, and bonus keywords, moving messages to obscure folders like RSS Feeds or Conversation History or deleting them outright. In at least one mailbox an incoming‑mail rule marked messages as read and deleted them, after which the mailbox was used to send outbound spam to hundreds of external recipients.
Sources and attribution signals
Huntress attributed token sources to multiple vectors: AitM relays behind fake sign-in pages, device‑code phishing, and social engineering during legitimate logins. The campaign was first observed coming from a Romanian IP address (193.26.115[.]221), which VirusTotal links to a remote access trojan called AsyncRAT and which is associated with a German hosting provider named 1337 Services GmbH. GreyNoise data identified 29 IPs matching that provider, with several flagged malicious or suspicious. The reporting also noted historical law‑enforcement action against related platforms (for example, an operation named Talent in January 2025) and the rebranding of services linked in reporting, but the researchers stopped short of a definitive attribution beyond the observed telemetry.
What defenders should look for
- Unexpected successful sign-ins from uncommon IP ranges or from patterns consistent with rapid token replay.
- Newly registered devices in Entra directories — especially devices that appear fake or unfamiliar.
- Changes to MFA methods, including removal of existing methods and rapid registration of new authenticators.
- Hidden or oddly named inbox rules that delete, move, or silently process messages (watch for rules targeting payroll, deposit, bonus, or similar keywords).
- Outbound spam activity originating from previously legitimate mailboxes.
Recommended mitigations
- Revoke sessions and reset affected account passwords.
- Audit Entra devices and remove any unauthorized or rogue device registrations.
- Review and restore legitimate MFA methods; investigate and remove any unknown authenticator registrations.
- Search for and remove unexpected inbox rules and any suspicious enterprise applications.
- Restrict device‑code workflows through Conditional Access Policies (CAP) to limit token issuance vectors.
On Conditional Access specifically, Huntress advised organizations to implement CAPs that require MFA (or block access) across All Users, All Cloud Apps, and All Client App types unconditionally, noting that properly configured CAPs can address security gaps that MFA alone does not cover.
Closing thoughts
This campaign highlights how modern attackers increasingly favor session‑and‑token abuse over password guessing, exploiting the legitimate authentication machinery to achieve stealthy access. The combination of AitM capture, device registration, and mailbox rule tampering demonstrates an operational playbook intended to persist and hide activity. For defenders, the window of opportunity lies in quick session revocation, thorough Entra device reviews, and tightening Conditional Access controls to reduce the available attack surface for token replay techniques.
Licensed under CC BY-ND 4.0 International