Skip to content
NewA calmer, faster ZeroHour
StoryPhishing & fraudhigh

M365 token replay hits email at 79 organizations

3 sources · 3 articlesFirst reported Updated ()1
What's new

October 23: Help Net Security added six replay addresses, device naming, a July 21 authenticator enrollment, and hundreds of September 11 sign-ins at nearly 30 organizations.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Huntress says stolen Microsoft 365 tokens were replayed for 497 successful sign-ins across 79 organizations from July 14 to September 22, 2026.

Huntress tracked a Microsoft 365 business-email compromise campaign that stole sign-in tokens through adversary-in-the-middle relays, device-code phishing and social engineering, then replayed them from IP space owned by German host 1337 Services GmbH. Across 79 organizations, attackers registered at least 48 rogue Entra devices, wiped and replaced MFA methods, and created inbox rules that hid or deleted mail. Huntress reports 497 successful sign-ins and more than 200,000 failed attempts from July 14 to September 22; Infosecurity Magazine describes at least 200,000 login attempts and the same 497 successes. A compromised mailbox sent payroll-themed phishing, and Infosecurity says no payment was obtained. Huntress says Conditional Access can block replay; containment requires revoking sessions, resetting passwords, and removing attacker devices and MFA methods.

Key facts
  • Replay used six addresses in 193.26.115.0/24 across four phases.
  • At least 48 rogue devices were named DESKTOP- plus eight hex characters.
  • MFA methods were replaced at 19 organizations, often within three hours.
  • Four organizations' Conditional Access blocked one later address 1,052 times.
  • A password reset alone does not remove an attacker-registered authenticator.
  • Huntress says a February 2025 Krebs article links the host's founder to Cracked.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jul 14, 2026Huntress campaign window of token replay begins. · Huntress
  2. Jul 21, 2026An iPhone 13 authenticator was added within an hour. · Help Net Security
  3. Sep 11, 2026One address completed hundreds of sign-ins over four days. · Help Net Security
  4. Sep 22, 2026Huntress observation window of the campaign ends. · Huntress
  5. Oct 22, 2026Huntress publishes findings on the token-replay campaign. · Huntress
  6. Oct 23, 2026Infosecurity and Help Net Security report the campaign. · Infosecurity Magazine

What each outlet adds

beyond the shared facts
  • HuntressNamed four flagged IPs and a 12-minute token replay.
  • Infosecurity MagazineSays the payroll lure did not result in payment.
  • Help Net SecuritySix addresses, device names, and 1,052 blocked replays.
Vendors
Microsoft
Products
Microsoft 365Microsoft Entra IDEntra
Organizations
Huntress1337 Services GmbH
Countries
Germany

Coverage

oldest first · one row per article · UTC
  1. · 3d ago HuntressFirst report

    M365 token spray and replay campaign hits 79 organizations

    Huntress saw 497 successful sign-ins and more than 200,000 failed attempts from July 14 to September 22, 2026.

  2. · 2d ago Infosecurity Magazine

    Token-spraying campaign hits Microsoft 365 accounts for email fraud

    Huntress counted at least 200,000 login attempts and 497 successful sign-ins from July to September 2026.

  3. · 2d ago Help Net Security

    Stolen Microsoft 365 sessions replayed at 79 organizations

    Huntress counted 497 successful sign-ins and over 200,000 failures from July 14 to September 22, with inbox rules hiding mail.