Skip to content
Hacker Posts

Microsoft 365 token spray-and-replay bypasses MFA at 79 orgs

Huntress details a July–September token spray-and-replay campaign that bypassed MFA at 79 organizations using AiTM relays, rogue Entra devices, and hidden inbox rules.

Published 3 min read
breachmicrosoftentra-idaitm

Huntress has documented a ten-week Microsoft 365 campaign that bypassed multi-factor authentication by stealing and replaying session tokens rather than guessing passwords. Over July 14 to September 22, 2026, Huntress responded to related incidents at 79 organizations, logging at least 497 successful sign-in events against more than 200,000 failed login attempts. Secondary coverage, including The Hacker News and ID Tech Wire, tallies 97 compromised accounts.

How it works

The attackers capture credentials, MFA codes, and the resulting token through adversary-in-the-middle (AitM) relays, with some tokens also sourced from device-code phishing. They then replay that stolen "proof of login" from their own infrastructure — Huntress calls it "token spraying." Because a valid token already cleared MFA, replay sails past it.

Persistence follows fast. Attackers registered at least 48 rogue Entra devices, and in 19 organizations they wiped existing MFA methods and registered a new one within three hours of the first campaign sign-in. Hidden inbox rules then quietly intercept mail.

Detection artifacts

Replay traffic came from IPs at German host 1337 Services GmbH (AS210558). The following indicators are copied verbatim from Huntress's report:

Replay hosts (1337 Services GmbH, AS210558):
  193.26.115[.]0/24
  193.26.115[.]221  193.26.115[.]199  193.26.115[.]16
  193.26.115[.]21   193.26.115[.]72   193.26.115[.]210
  124.198.132[.]33  45.83.31[.]44     192.159.99[.]172

AiTM relays:
  185.238.2[.]195
  2400:8d60:2::1:841d:5dd  (Evoxt Sdn. Bhd.)

Payroll-rule creator (Interserver):
  167.148.41[.]96

Rogue Entra devices were named DESKTOP- plus eight hex characters (for example DESKTOP-54521F46); Windows' default is DESKTOP- plus seven alphanumeric characters, so the pattern is suggestive, not conclusive. Huntress' hidden inbox rules, verbatim:

Rule nameActionTrigger / destination
.Mark read, deleteAll mail
sssMark read, deleteAll mail
ssMove to RSS Feeds, mark readMail mentioning a partner domain
iTMove to Conversation History, mark readAll mail
,.Move to Conversation History, mark readAll mail
........Move to RSS Subscriptions, mark readAll mail
sHideSubject/body: payroll, direct deposit, bank, bonus
dMove to Conversation History, mark readOne external CPA address

Action checklist

  1. For any suspected victim, revoke sessions and reset the password — a reset alone leaves attacker-registered devices and MFA methods in place.
  2. Audit Entra registered devices for the DESKTOP-, Device-, and Work Pc patterns Huntress flags, and remove rogue entries after confirming.
  3. Review each mailbox for hidden inbox rules with terse, forgettable names, especially any filtering payroll or finance keywords.
  4. Restrict the device-code authentication flow with Conditional Access; it is a recurring token-theft vector here.
  5. Enforce phishing-resistant MFA through Conditional Access across all users and client app types — token replay is defeated by properly scoped CAP, not by MFA alone.

Context

Token theft keeps outrunning MFA because the industry treated MFA as the finish line. This is the same AitM relay pattern seen against Taiwanese researchers phished with a Google AitM kit and behind the wave of M365 tenant compromises via ConnectWise cloud backup. The through-line: once a session token is stolen, the only durable control is Conditional Access that constrains where and how a token can be used — and fast revocation when it is.

Related stories