Microsoft 365 token-replay campaign hit 97 accounts at 79 organizations
Original title: Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Huntress logged 497 successful sign-ins and 48 rogue Entra devices between July 14 and September 22, 2026.
Huntress says attackers used adversary-in-the-middle login pages to capture Microsoft 365 credentials, MFA codes, and access tokens, then replayed those tokens at scale. From more than 200,000 attempts tied to 193.26.115.0/24, they completed 497 sign-ins, compromised 97 accounts, and registered 48 rogue Entra devices. After access, they added authenticator apps, sometimes replaced MFA methods, and created hidden inbox rules aimed at payroll and payment mail. Huntress advises revoking sessions, resetting passwords, and tightening Conditional Access, including device-code flows.
Unconfirmed: VirusTotal associates 193.26.115.221 with AsyncRAT, but Huntress does not say the campaign used that malware.
- Tokens also came from device-code phishing and social engineering during legitimate logins.
- In at least 19 organizations, MFA methods were replaced within three hours.
- One July 21 case added an authenticator named "iPhone 13" in under 51 minutes.
- Inbox rules used short names and deleted or hid payroll, deposit, and bonus mail.
- The first observed address, 193.26.115.221, is tied to German host 1337 Services GmbH.
Impact: Hijacked Microsoft 365 sessions and mailbox access
| Product | Affected |
|---|---|
| Microsoft 365 | — |
- 1.Revoke sessions and reset passwords on suspected accounts.
- 2.Audit Entra devices, MFA methods, inbox rules, and new enterprise applications.
- 3.Restrict device-code sign-in with Conditional Access policies.
- ATT&CK
- T1557 Adversary-in-the-MiddleT1550.001 Application Access TokenT1098 Account ManipulationT1564.008 Email Hiding Rules
- Vendors
- Microsoft
- Products
- Microsoft 365Microsoft Entra
- Organizations
- Huntress1337 Services GmbH
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | exy.sh | platforms are operational, with the former now rebranded as exy[.]sh . "StarkRDP has always been operating by the law and is n |
| domain | rdp.sh | d suspicious. Notably, the entity is linked to StarkRDP and rdp[.]sh , which allows paying customers to rent virtual servers. |
| ipv4 | 193.26.115.221 | he campaign was first observed from a Romanian IP address " 193.26.115[.]221 ," which, according to VirusTotal, is used by a remote ac |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.