M365 Token Spray and Replay Campaign

Between 14 July and 22 September 2026 an unattributed operator took over Microsoft 365 mailboxes at 79 organizations without needing the victim's password at replay time. Huntress observed the activity in its own customer environments. Victims were phished through adversary in the middle relays that proxied the real Microsoft login and MFA prompt, or through device code phishing and social engineering. The operator kept the session token issued after MFA and replayed it from hosting addresses, mostly in 193.26.115.0/24 (AS210558, 1337 Services GmbH), within minutes of the user completing MFA.

Huntress describes two tooling builds. Build A is scripted (node user agent, Office or Authentication Broker client). Build B is browser based (current Chrome or Edge on Windows, OfficeHome client). After replay the operator registered at least 48 rogue Entra devices named DESKTOP- plus eight hex characters. At 19 organizations existing MFA methods were removed and a new method registered within three hours of the first campaign sign-in. In one case the new authenticator was labeled iPhone 13. Rogue devices and replaced MFA methods survive a password reset.

The operator hid its activity with inbox rules named with one to three characters or only punctuation. In one case it used rules to hide a payroll fraud attempt against an outside accountant. Huntress recorded at least 497 successful sign-ins and more than 200,000 failed attempts. Conditional Access blocked 1,052 sign-ins at four organizations. Huntress does not name an actor.