INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Microsoft 365 Token-Replay Attacks Compromise Accounts at 79 Organizations

| 2026-10-26 08:35 LOW HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A Microsoft 365 token-replay attack compromised 97 accounts at 79 organizations between July 14 and September 22, 2026. The attackers used an adversary-in-the-middle (AitM) relay to capture sign-in sessions and replay stolen tokens to break into email accounts. Huntress detected over 200,000 login attempts across the victim organizations from which they traced more than 200,000 failed login attempts back to a specific IP range. The attack involved device-code phishing and social engineering during legitimate login processes, with attackers registering at least 48 fake computers in Microsoft directories and setting up hidden email rules to delete or move incoming mail.
Technical Mitigations AI-generated
• Patch Microsoft 365 to address the vulnerability in the AitM relay, which is currently unpatched. • Block IP addresses associated with AsyncRAT and 1337 Services GmbH (e.g., 193.26.115[.]0/24) from accessing your network. • Implement a robust MFA solution that detects and blocks device-code phishing attempts using techniques such as machine learning-based authentication or behavioral analysis. • Hunt for rogue Entra devices registered with fake names, such as "iPhone 13", to prevent attackers from persisting in the system.
Technical Observables 3 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 3 IoCs Create Free Account
domains 2 ips 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎January 2025
Threat actors used compromised domains linked to StarkRDP and rdp.sh, as well as websites for Nulled, Cracked, and Sellix, in an international law enforcement operation dubbed Talent.
observable rdp.sh
The domains linked to both StarkRDP and rdp[.]sh were taken down , alongside websites for Nulled, Cracked, and Sellix, as part of an international law enforcement operation dubbed Talent in January 2025.
organisation Entra
" Organizations who suspect a token replay compromise are recommended to revoke sessions and reset the password, audit Entra devices, review MFA methods, check for unexpected inbox rules or new enterprise applications, and restrict device-code workflow with Conditional Access policies.
organisation Conditional Access
" Organizations who suspect a token replay compromise are recommended to revoke sessions and reset the password, audit Entra devices, review MFA methods, check for unexpected inbox rules or new enterprise applications, and restrict device-code workflow with Conditional Access policies.
organisation CAP
"Conditional Access Policies (CAP) can help fill some of the security gaps that MFA can't, as long as they're appropriately implemented," Huntress researchers said.
‎January 30
StarkRDP denied involvement in alleged Microsoft 365 token-replay attacks, stating they operated by the law.
‎July 21, 2026
Threat actors used a remote access trojan called AsyncRAT to target Microsoft 365 accounts, hijacking sessions and activating new authenticator apps within minutes.
infrastructure 13 iPhone
In one case observed on July 21, 2026, the threat actors activated a new authenticator app named "iPhone 13" less than 51 minutes after the session was hijacked.
general_metric 51 minutes
In one case observed on July 21, 2026, the threat actors activated a new authenticator app named "iPhone 13" less than 51 minutes after the session was hijacked.
organisation Rogue
"Rogue devices served the same purpose," the researchers said.
organisation RSS Feeds
Furthermore, the attackers have also been spotted setting up hidden email rules in victims' inboxes with names such as ".," "sss," "ss," "iT," ",.," "........," "s," and "d" to delete incoming mail with certain keywords referencing payroll, deposit, and bonus, or move them to obscure folders like RSS Feeds and Conversation History.
organisation Microsoft Entra ID Protection
The mailbox was then used to send outbound spam to hundreds of external recipients before Microsoft Entra ID Protection rated the account high risk.
organisation GreyNoise
The IP address is associated with a German hosting provider named 1337 Services GmbH. Data from GreyNoise currently lists 29 IP addresses matching the hosting provider, out of which 10 have been flagged as malicious and five are marked suspicious.
infrastructure 29 IP addresses
The IP address is associated with a German hosting provider named 1337 Services GmbH. Data from GreyNoise currently lists 29 IP addresses matching the hosting provider, out of which 10 have been flagged as malicious and five are marked suspicious.
‎September 22, 2026
Threat actors replayed stolen Microsoft 365 sign-in tokens to compromise accounts at 97 organizations, including those with compromised MFA methods.
infrastructure Microsoft 365
The "proof of login" token is subsequently replayed by the attacker from their own devices within minutes to conduct automated sign-in attempts against Microsoft 365 services.
organisation IP
"Rather than guessing passwords, the attacker replayed sign-in tokens stolen from victims, and we've traced more than 200,000 failed login attempts from the campaign window back to the 193.26.115[.]0/24 IP range," Huntress researchers Andrea Hatcher, Susannah Matt, Matt Poto, and Andrew Schwartz said.
organisation MFA
The attack has been found to employ an AitM login page, which sits between the victims and legitimate Microsoft infrastructure to capture the entered credentials and MFA codes and relay the information to the real login page.
victims 19 organizations
In no less than 19 organizations, the victim's existing MFA methods were removed and a new method registered within three hours of the first sign-in.
‎between July 14 and September 22, 2026
Threat actors used Microsoft 365 to target multiple organizations, resulting in the compromise of 97 accounts and registration of rogue Entra devices.
infrastructure Microsoft 365
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
general_metric 365 Microsoft
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
general_metric 97 Accounts
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
organisation Huntress
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
general_metric 497 successful sign events
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
general_metric 200,000 login attempts
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
infrastructure 48 rogue Entra devices
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
‎2026/10/26
Threat actors used an adversary-in-the-middle relay to capture Microsoft 365 sign-in sessions and replay the stolen tokens to break into email accounts at 79 organizations.
infrastructure Microsoft 365
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations.
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle ( AitM ) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
organisation Microsoft
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations.
organisation Token-Replay Attacks Compromise
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations.
victims 79 Organizations
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations.
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle ( AitM ) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations.
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle ( AitM ) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
The "proof of login" token is subsequently replayed by the attacker from their own devices within minutes to conduct automated sign-in attempts against Microsoft 365 services.
Metrics
victims
79
Organizations
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations.
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle ( AitM ) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
Metrics
infrastructure
48
Rogue Entra Devices
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
Metrics
infrastructure
13
Iphone
In one case observed on July 21, 2026, the threat actors activated a new authenticator app named "iPhone 13" less than 51 minutes after the session was hijacked.
Metrics
infrastructure
29
Ip Addresses
The IP address is associated with a German hosting provider named 1337 Services GmbH. Data from GreyNoise currently lists 29 IP addresses matching the hosting provider, out of which 10 have been flagged as malicious and five are marked suspicious.
Metrics
victims
19
Organizations
In no less than 19 organizations, the victim's existing MFA methods were removed and a new method registered within three hours of the first sign-in.
Intelligence Sources
The Hacker News 2026-10-26