Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
A Microsoft 365 campaign used adversary-in-the-middle (AitM) relays to steal sign-in tokens, bypassing MFA and compromising 97 accounts across 79 organizations.
Intelligence analysis by Gemini 2.5 Flash
Cybersecurity researchers at Huntress observed a sophisticated campaign between July and September 2026, where attackers leveraged AitM phishing pages to capture legitimate sign-in sessions and replay stolen tokens. This method, dubbed 'token spraying,' allowed them to gain unauthorized access to Microsoft 365 email accounts, register rogue devices for persistence, and set up hidden e…
Imagine you have a special ticket to get into a secret club, and you also have a secret handshake (that's like MFA) to prove it's really you. Sneaky people found a way to steal your ticket right after you show it, and then they use *your* ticket to get into the club themselves, even without knowing the secret handshake! Once inside, they might even make their own special badge so they can keep coming back whenever they want, and even try to hide messages meant for you.
Analysis
Huntress' Findings
Cybersecurity firm Huntress played a pivotal role in uncovering and detailing this sophisticated Microsoft 365 token-replay campaign. Their observations, spanning from July 14 to September 22, 2026, revealed a concerted effort by threat actors to compromise organizational accounts. Huntress detected nearly 500 successful Microsoft 365 sign-in events resulting from over 200,000 login attempts, ultimately leading to the compromise of 97 accounts and the registration of 48 rogue Entra devices across 79 victim organizations. This extensive data collection underscores the scale and persistence of the attack, providing crucial insights into the adversary's tactics.
The researchers specifically noted that the attackers did not rely on traditional password guessing but rather on replaying stolen sign-in tokens. This technique effectively circumvents multi-factor authentication, which is typically considered a strong defense. Upon gaining access, the attackers swiftly moved to establish persistence by adding their own authenticator apps or registering fake devices, ensuring continued access even if the initial session token expired. In some instances, existing MFA methods were removed and new ones registered within hours, indicating a rapid and automated post-compromise playbook.
1337 Services GmbH
The infrastructure supporting these token-replay attacks has been traced back to a Romanian IP address, 193.26.115[.]221, which is associated with the remote access trojan AsyncRAT. This IP address, along with others flagged as malicious or suspicious, is linked to a German hosting provider named 1337 Services GmbH. This connection is significant as 1337 Services GmbH is also tied to StarkRDP and rdp[.]sh, platforms that facilitate the rental of virtual servers, often used by malicious actors.
Notably, StarkRDP and rdp[.]sh were previously targeted in an international law enforcement operation dubbed 'Talent' in January 2025, which resulted in the takedown of associated domains. Despite this, the platforms have since re-emerged, with StarkRDP rebranding as exy[.]sh, demonstrating the resilience and adaptability of such illicit services. The continued operation of these hosting providers, even after law enforcement intervention, highlights the ongoing challenge in disrupting the infrastructure used by cybercriminals for campaigns like the Microsoft 365 token-replay attacks.
Conditional Access Policies
To mitigate the risks posed by token-replay attacks and similar sophisticated threats, cybersecurity experts emphasize the importance of robust security measures, particularly Conditional Access Policies (CAPs). These policies can fill critical security gaps that traditional MFA alone might not address, provided they are implemented correctly. CAPs allow organizations to define conditions under which users can access cloud applications, enabling granular control over authentication and authorization processes.
Huntress researchers specifically recommend that businesses configure CAPs to require MFA or block access for all users, all cloud applications, and all client app types unconditionally. This comprehensive approach ensures that even if a token is stolen, the attacker would still face additional hurdles imposed by the conditional access rules, such as requiring a compliant device or a specific network location. By strategically deploying and continuously reviewing CAPs, organizations can significantly enhance their defense against advanced persistent threats and token-based attacks, making it harder for adversaries to maintain access and execute their objectives.
Key points
- A Microsoft 365 campaign used adversary-in-the-middle (AitM) relays to steal sign-in tokens, bypassing MFA.
- The attacks compromised 97 accounts across 79 organizations, with attackers registering 48 rogue Entra devices for persistence.
- Attackers established persistence by adding their own authenticator apps and setting up hidden email rules to delete or move sensitive incoming mail.
- The campaign's infrastructure is linked to a Romanian IP address and a German hosting provider, 1337 Services GmbH, associated with services like StarkRDP.
- Cybersecurity researchers recommend revoking sessions, auditing Entra devices, reviewing MFA methods, and implementing Conditional Access Policies to mitigate risks.
The detailed disclosure by Huntress provides organizations with actionable intelligence to detect and defend against these sophisticated token-replay attacks. Implementing recommended security measures like robust Conditional Access Policies and auditing Entra devices can significantly strengthen defenses and prevent future compromises.
Despite law enforcement efforts, the re-emergence of hosting providers like StarkRDP (now exy[.]sh) suggests a persistent challenge in dismantling the infrastructure used by threat actors. The sophistication of token-replay attacks, which bypass traditional MFA, indicates that organizations face an ongoing and evolving threat landscape requiring continuous vigilance and adaptation.
