Microsoft 365 Token-Replay Attacks Compromise 97 Accounts

497 successful Microsoft 365 sign‑in events, 97 accounts compromised, and 48 rogue devices registered across 79 organizations — all traced to more than 200,000 login attempts during a single campaign observed between July 14 and September 22, 2026.

How the "token spraying" attack works

Researchers at Huntress describe an adversary‑in‑the‑middle (AitM) campaign that does not rely on cracking passwords. Instead, attackers placed fake sign‑in pages between users and Microsoft’s real login flow to capture full sign‑in sessions, including MFA codes. The attackers collected the resulting access tokens — the “proof of login” issued by Microsoft — and replayed them from their own devices within minutes to access Microsoft 365 services. Huntress dubbed the technique token spraying because stolen tokens were replayed at scale across multiple organizations, analogous to password spraying.

Scale, outcomes, and a simple trace

Between July 14 and September 22, 2026, Huntress detected 497 successful Microsoft 365 sign‑in events across 79 victim organizations out of more than 200,000 login attempts. Those events led to 97 compromised accounts and 48 registered rogue Entra devices. “Rather than guessing passwords, the attacker replayed sign‑in tokens stolen from victims, and we've traced more than 200,000 failed login attempts from the campaign window back to the 193.26.115[.]0/24 IP range,” Huntress researchers Andrea Hatcher, Susannah Matt, Matt Poto, and Andrew Schwartz wrote.

Persistence: authenticator apps and rogue Entra devices

After using stolen tokens to gain entry, attackers moved quickly to make access more durable. In no fewer than 19 organizations the existing MFA methods were removed and a new method registered within three hours of the first sign‑in. Huntress observed one case on July 21, 2026, where the attackers activated an authenticator app labeled “iPhone 13” less than 51 minutes after the session was hijacked.

Rogue devices served a similar purpose. Attackers registered at least 48 fake computers in victims’ Microsoft directories. A registered device can provide a more durable way to request tokens than a single stolen session and remains in the directory until an administrator deletes it.

Mailbox manipulation and abuse

Compromised mailboxes were altered to hide and divert notifications while preserving the attacker’s ability to operate. Huntress found hidden inbox rules with names such as ".", "sss", "ss", "iT", ",.", "........", "s", and "d" that deleted or moved messages containing payroll, deposit, or bonus keywords into obscure folders like RSS Feeds and Conversation History. In one mailbox an inbox rule marked all incoming messages as read and deleted them; that account was later used to send outbound spam to hundreds of recipients before being flagged high risk by Microsoft Entra ID Protection.

Infrastructure links: IPs, malware, and hosting platforms

The campaign’s activity was first observed from the Romanian IP address 193.26.115[.]221, which VirusTotal associates with the AsyncRAT remote access trojan. Huntress traced a broader set of more than 200,000 failed attempts to the 193.26.115[.]0/24 range, and GreyNoise data lists 29 IP addresses that match the same German hosting provider, 1337 Services GmbH — 10 of those IPs are flagged malicious and five are marked suspicious.

Huntress also linked the hosting ecosystem to marketplaces and platforms: StarkRDP and rdp[.]sh — platforms that allow paying customers to rent virtual servers — were previously seized or taken down as part of an international law enforcement operation dubbed Talent in January 2025 but, according to Huntress, are operational again with StarkRDP rebranded as exy[.]sh. The StarkRDP Telegram account told independent cybersecurity journalist Brian Krebs on January 30 that “StarkRDP has always been operating by the law and is not involved in any of these alleged crimes,” and that the platform planned to restart under a different name.

What this means for technologists, affected enterprises, and end users

• Technologists and security teams: Huntress recommends immediate session revocation and password resets for suspected compromises, auditing Entra devices and MFA methods, checking for unexpected inbox rules and new enterprise applications, and restricting device‑code workflows with Conditional Access policies.
• Affected enterprises and procurement leaders: The campaign shows how rented infrastructure and third‑party platforms can be woven into large‑scale replay operations; organizations should audit service providers and review device registration policies in their directories.
• End users: The attack highlights that entering credentials on an apparently legitimate page can still result in token theft; users and admins should watch for unexpected MFA changes and for unusual mailbox rules that hide critical notifications.

Huntress advised businesses setting up Conditional Access Policies to require MFA — or block — for All Users, All Cloud Apps, and All Client App types unconditionally, noting that Conditional Access can fill security gaps MFA alone does not cover.

The campaign is a reminder that credential theft can be effective without classic brute force. The facts here are narrow and specific: a named IP range, nearly half a thousand successful sign‑ins, dozens of rooted devices and altered mailboxes. The open question left by those facts is operational: how many organizations will detect and remove the rogue devices and authenticator entries before attackers turn them into long‑term access paths?

Read the original Huntress reporting at https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html.