Token replay attacks breach Microsoft 365 accounts at 79 organizations
Huntress has identified a Microsoft 365 campaign in which attackers used token replay to compromise 97 accounts across 79 organizations. Observed between July 14 and September 22, 2026, the activity generated 497 successful Microsoft 365 sign-ins from more than 200,000 login attempts and resulted in the registration of 48 rogue Entra devices.
The campaign did not rely on password guessing. Instead, the attackers captured sign-in sessions and replayed stolen tokens to enter victims’ email accounts. Huntress traced more than 200,000 failed attempts during the campaign window to the 193.26.115[.]0/24 IP range.
How the token replay operation worked
The attackers used adversary-in-the-middle, or AitM, login pages placed between a victim and legitimate Microsoft infrastructure. These pages captured credentials and MFA codes, relayed them to the real login page, and collected the access token issued after a successful sign-in.
That token served as proof that the user had completed the login process. The attackers could replay it from their own devices within minutes and automate attempts against Microsoft 365 services without having to bypass MFA again. Huntress called the technique token spraying, comparing its scaled reuse of stolen tokens across organizations with password spraying.
Huntress said the stolen tokens came from several channels, including AitM relays behind fraudulent sign-in pages, device-code phishing, and social engineering during a legitimate login process. The campaign was first seen from Romanian IP address 193.26.115[.]221, which VirusTotal associates with the AsyncRAT remote-access trojan. The address is associated with German hosting provider 1337 Services GmbH.
Persistence through MFA and device changes
After obtaining access, the operators added their own authenticator application so they could complete MFA prompts on future sign-ins. This persistence route could remain useful if the originally stolen session token expired or was revoked by the victim.
At no fewer than 19 organizations, an existing MFA method was removed and a new method was registered within three hours of the first sign-in. In one incident on July 21, 2026, a new authenticator app named iPhone 13 was activated less than 51 minutes after the session was hijacked.
Rogue Entra device registrations provided another persistence mechanism. Huntress recorded at least 48 fake computers added to victim Microsoft directories. A registered device can offer a more durable route for requesting tokens than a stolen session, and it remains in the directory until an administrator removes it.
Mailbox manipulation and response steps
The attackers also created concealed inbox rules with names such as .,, sss, iT and strings of dots. The rules deleted messages containing terms related to payroll, deposits and bonuses, or moved messages to folders such as RSS Feeds and Conversation History. In one compromised mailbox, all incoming messages were marked as read and deleted before the account sent spam to hundreds of external recipients.
For a suspected token-replay compromise, Huntress recommends revoking sessions and resetting the password, auditing Entra devices and MFA methods, and checking for unexpected inbox rules or new enterprise applications. Organizations should also restrict device-code workflows with Conditional Access policies. The practical business implication is that MFA alone does not end the investigation: security teams need to treat session tokens, authenticator changes, device registrations and mailbox rules as connected evidence of identity compromise.