Attackers compromised 97 Microsoft 365 accounts across 79 organizations by replaying stolen sign-in tokens, according to Huntress findings described in The Hacker News. The campaign also involved registering 48 rogue Microsoft Entra devices, giving attackers another way to maintain access.
Huntress observed the activity between July 14 and September 22, 2026. Its researchers identified 497 successful Microsoft 365 sign-in events and traced more than 200,000 failed login attempts to the 193.26.115[.]0/24 IP range. Successful sign-in events represent repeated activity, rather than a count of distinct compromised accounts.
Stolen tokens carried access past MFA
The campaign used adversary-in-the-middle phishing pages positioned between victims and legitimate Microsoft sign-in infrastructure. These pages captured credentials and multifactor authentication codes, relaying them to Microsoft to complete authentication.
The attackers then captured the token issued after sign-in and replayed it from their own devices within minutes. Because the token represented an authenticated session, the attackers could use it without completing the victim’s MFA challenge again.
Huntress called the approach “token spraying”: replaying many stolen tokens across multiple organizations at scale, in a pattern comparable to password spraying. The researchers said tokens came from several sources, including phishing relays, device-code phishing and social engineering during legitimate login processes.
Attackers added ways to retain access
After gaining access, the attackers registered their own authenticator apps so they could complete MFA challenges during subsequent sign-ins, including after a stolen session expired or was revoked.
In at least 19 organizations, existing MFA methods were removed and a replacement registered within three hours of the first sign-in. In one case observed on July 21, an attacker activated an authenticator app named “iPhone 13” less than 51 minutes after hijacking the session.
The rogue device registrations provided another persistence mechanism. According to Huntress, a registered device can offer a more durable way to request tokens than a stolen session alone and remains in the organization’s directory until it is deleted.
The attackers also created hidden inbox rules with inconspicuous names such as “sss,” “iT” and “........”. These rules deleted incoming messages containing terms related to payroll, deposits and bonuses, or moved them into folders such as RSS Feeds and Conversation History.
In one compromised mailbox, a rule marked every incoming message as read and deleted it. The account subsequently sent spam to hundreds of external recipients before Microsoft Entra ID Protection classified it as high risk.
Recovery includes reviewing account changes
For organizations that suspect token replay, Huntress recommended revoking sessions and resetting passwords, alongside auditing Entra devices and reviewing registered MFA methods. Its guidance also covered checking for unexpected inbox rules or new enterprise applications and restricting device-code workflows through Conditional Access policies.
Those checks address changes attackers made after gaining access: a stolen session was only one part of the intrusion, while added authentication methods, registered devices and mailbox rules could remain in place.
