Token replay gave attackers Microsoft 365 access at 79 organizations
Original title: Microsoft 365 Token Replay Attacks Let Hackers Access Business Emails Without Passwords
Huntress logged 497 successful sign-ins and over 200,000 failures from July 14 to September 22, 2026.
Huntress says attackers reached Microsoft 365 at 79 organizations by replaying stolen sign-in sessions after adversary-in-the-middle phishing, device-code phishing, and social engineering. Victims completed multifactor authentication on relayed pages; captured sessions then opened Microsoft services without a password or a new MFA challenge. Operators registered at least 48 rogue Entra devices, swapped MFA methods at 19 organizations, and used inbox rules to support business email compromise. Password resets do not remove attacker authenticators or rogue devices.
Unconfirmed: Huntress says use of 1337 Services GmbH addresses does not show the provider took part.
- The ten-week activity ran from July 14 through September 22, 2026.
- Replay hosts sat mainly in 193.26.115.0/24, tied to 1337 Services GmbH (AS210558).
- Scripted OAuth2 token requests targeted Graph, Exchange, SharePoint, and device registration.
- Rogue device names followed DESKTOP- plus eight uppercase hexadecimal characters.
- One payroll lure went to an external accountant while rules hid related mail.
Impact: Microsoft 365 mailbox access and persistent Entra footholds
- 1.Revoke compromised sessions, reset passwords, and remove rogue devices and MFA methods.
- 2.Delete unauthorized inbox rules and review mailbox activity after hosting-origin sign-ins.
- 3.Restrict unnecessary device-code flows and cover users and apps with Conditional Access.
- ATT&CK
- T1557 Adversary-in-the-MiddleT1550.001 Application Access TokenT1098 Account ManipulationT1564.008 Email Hiding Rules
- Vendors
- Microsoft
- Organizations
- Huntress1337 Services GmbH
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.238.2.195 | ly 21, a victim reached an MFA prompt through relay address 185.238.2[.]195 at 17:18 UTC. Twelve minutes later, the hijacked session |
| ipv4 | 193.26.115.16 | 3). 193.26.115[.]199 Build B session replay host (Phase 1). 193.26.115[.]16 Build A token replay host; device-code phishing (Phase 2) |
| ipv4 | 193.26.115.199 | and rogue device join host (Phase 1, July 14 to August 3). 193.26.115[.]199 Build B session replay host (Phase 1). 193.26.115[.]16 Bu |
| ipv4 | 193.26.115.21 | Build A token replay host; device-code phishing (Phase 2). 193.26.115[.]21 Build A token replay host, bare Mozilla/5.0 user agent (P |
| ipv4 | 193.26.115.221 | r initial containment actions finish. IOCs Item Description 193.26.115[.]221 Build A token replay and rogue device join host (Phase 1, |
From the original article
3 min read at gbhackers.com
Hackers accessed Microsoft 365 environments at 79 organizations by replaying stolen sign-in sessions, letting them enter business accounts without victims’ passwords. Huntress recorded 497 successful sign-ins and more than 200,000 failed attempts during the ten-week campaign, which ran from July 14 through September 22, 2026. Use of the provider’s network does not establish its involvement […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.