M365 token spray and replay campaign hits 79 organizations
Original title: M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress saw 497 successful sign-ins and more than 200,000 failed attempts from July 14 to September 22, 2026.
Huntress tracked a Microsoft 365 campaign that stole sign-in tokens through adversary-in-the-middle relays, device-code phishing and social engineering, then replayed them from IP space owned by German host 1337 Services GmbH. Across 79 organizations, attackers registered at least 48 rogue Entra devices, wiped and replaced MFA methods, and created inbox rules. In one case a compromised account sent a payroll-related email to an outside contact. Huntress says properly implemented Conditional Access can prevent replay, and containment requires revoking sessions, resetting the password, and removing attacker devices and MFA methods.
Unconfirmed: A Krebs on Security article only suggests that 1337 Services GmbH's founder may have operated the Cracked forum.
- Microsoft Entra ID Protection flagged 193.26.115[.]221, [.]72, [.]16 and [.]21 as threat-actor IPs.
- In one case, a token stolen at an MFA prompt was replayed within about 12 minutes.
- In 19 organizations, existing MFA methods were replaced within three hours of the first campaign sign-in.
- A February 2025 Krebs article suggests the host's founder may have run the Cracked forum.
Impact: Stolen M365 tokens used to take over business email accounts
| Product | Affected |
|---|---|
| Microsoft 365 | — |
- 1.Use properly implemented Conditional Access policies to block token replay.
- 2.Revoke the user's sessions and reset the password.
- 3.Remove attacker-registered Entra devices and rogue MFA methods.
- ATT&CK
- T1557 Adversary-in-the-MiddleT1550.001 Application Access TokenT1098 Account ManipulationT1564.008 Email Hiding Rules
- Vendors
- Microsoft
- Products
- Microsoft 365Microsoft Entra ID
- Organizations
- Huntress1337 Services GmbH
- Countries
- Germany
From the original article
13 min read at huntress.comHuntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.