.jpg "Microsoft 365 Email Accounts Targeted in Multi-Phase Token Replay Campaign")
.jpg)
By exploiting stolen authentication tokens instead of passwords, a cyber campaign targeting Microsoft 365 compromised email accounts for 79 organizations. During the period July 14-22, 2026, cybersecurity firm Huntress reported unauthorized access to business accounts was gained by replaying stolen login sessions for ten weeks, using stolen login sessions.
Research indicated that there were approximately 497 successful login attempts during the investigation, compared to more than 200,000 failed login attempts. The campaign relied on infrastructure provided by 1337 Services GmbH, a hosting provider based in Hamburg, Germany. Microsoft Entra ID Protection also flagged several IP addresses associated with the activity, indicating that portions of the infrastructure had been identified as suspect. This attack highlights the vulnerability of conventional account protection.
Although multi-factor authentication (MFA) was enabled during legitimate sign-ins, attackers exploited this mechanism to capture authentication tokens after the user completed the verification process. As a result of these tokens, Microsoft 365 services could be accessed without the attacker having to enter the account password or repeat the MFA challenge.
Stolen Authentication Tokens Bypass MFA Protection
There have been several techniques employed by researchers to obtain valid authentication tokens, including adversary in the middle (AiTM) phishing, device-code phishing, and social engineering. In AiTM attacks, victims are directed to fraudulent sign-in pages that relay requests to Microsoft's genuine login service.
Once the user enters their credentials and completes MFA, the relay captures the session token resulting from that action. Having successfully authenticated a user, the token can be reused by an attacker without requiring the user to complete the original verification process again. Another method is device-code phishing, which tricked the victim into entering a code on Microsoft's valid sign-in page, enabling the attacker to control the session without being aware.
According to Huntertress, token spray is an approach to attempting access at scale by reusing stolen tokens across multiple organizations in a similar manner to password spraying. In place of repeatedly guessing passwords, attackers used already authenticated sessions to attempt access to multiple organizations.
The stolen sessions were often used within minutes of being stolen. During one incident on July 21, the attacker accessed a hijacked session 12 minutes after the victim reached the MFA prompt. During another incident on September 22, the interval was only four minutes. The campaign also involved repeated changes to its infrastructure.
Attackers rotated between six IP addresses within the range 193.26.115.0/24, returning in multiple waves separated by periods of inactivity, rotating between the six IP addresses in succession. Using this approach, it was difficult to block specific addresses since activity could continue from another address in the same range.
After gaining initial access, attackers attempted to maintain control over compromised accounts and conceal suspicious activity, increasing the risk that further business email compromises will occur.
Attackers Compromise 79 Organizations Through Microsoft 365 Token Replay
A number of methods were also used to maintain access after the initial compromise by Huntress, including identifying 48 unauthorized devices registered in the Microsoft Entra directories of victims. The attackers were able to retain access even after stolen sessions expired by removing existing multi-factor authentication (MFA) methods and registering new ones within three hours of the first suspicious sign-in in 19 organizations.
A password reset alone will not remove these unauthorized devices or authentication methods, leaving compromised accounts exposed unless administrators review and remove them. However, they can create their own authenticator methods to complete future login verification. As well as creating concealed inbox rules for hiding messages from account owners, attackers also created concealed inbox rules.
A number of rules automatically marked incoming emails as read, deleted them, or moved them into folders such as RSS Feeds and Conversation History. These rules typically contained short names or punctuation, which rendered them less visible during routine checks. An external accountant was contacted by an e-mail relating to payroll related issues using a compromised mailbox.
Using the attacker's rule, he was able to capture messages containing terms such as "payroll," "direct deposit," "bank," and "bonus," and then added another rule to hide the accountant's responses. As a result of this approach, fraudulent payment requests may continue, without the account owner being aware of the conversation.
Attack Infrastructure Shifted Across Multiple Phases Over the course of four phases from July 14 to September 22, 2026, Hunters tracked the operation. In order to capture and replay sign-in tokens, the attackers rotated between six IP addresses associated with German hosting provider 1337 Services GmbH, using separate infrastructure.
In addition to 497 successful sign-ins across 79 organizations, over 200,000 unsuccessful attempts were recorded as part of the investigation. The Microsoft Entra ID Protection system flagged several addresses associated with the activity during a four-day burst in September. One address recorded hundreds of successful sign-ins from dozens of organizations. The campaign utilized scripted token replays as well as browser-based session replays.
A device-code phishing scheme, which involves tricking users into entering a code on Microsoft's legitimate sign-in page, was also employed in the campaign, enabling hackers to authorize sessions without obtaining account credentials. Huntress did not attribute the campaign to a specific threat group or country.
The findings emphasize instead how stolen session tokens can compromise account security even with multi-factor authentication enabled. Conditional Access Policies Can Help Limit Exposure Using Conditional Access policies, Hunters recommends requiring multi-factor authentication (MFA) or blocking access to all users, cloud applications, and client applications. These policies were able to stop more than a thousand sign-in attempts from a single attacker-controlled address across four organizations during the observed campaign, demonstrating their effectiveness when properly configured.
When a token replay incident is suspected, administrators need to revoke active sessions, reset passwords, and audit Entra devices and MFA methods registered with the network. Checkbox rules for unusual names, unexpected message deletions, and rules that redirect payroll or banking correspondence to avoid unusual names.
Additionally, organizations should review suspicious sign-ins and restrict device-code authentication in situations where it is not necessary. According to the campaign, addressing token theft involves more than simply changing passwords.
In order to prevent attackers from returning to compromised Microsoft 365 accounts, it is also necessary to remove unauthorized authentication methods, invalidate sessions, and identify concealed mailbox activity.
