Executive Summary
A large-scale Microsoft 365 campaign, active between July and September 2026, compromised 97 accounts across 79 organizations by leveraging Adversary-in-the-Middle (AitM) relays and token-replay techniques. The attackers successfully bypassed Multi-Factor Authentication (MFA) by capturing and replaying session tokens, a technique researchers call "token spraying." The infrastructure used in this campaign has been linked to 1337 Services GmbH and the remote access trojan AsyncRAT.
Technically, the attackers moved beyond initial access to establish long-term persistence by registering at least 48 rogue Entra devices and adding unauthorized authenticator apps (e.g., named "iPhone 13") to victim accounts. They also implemented obfuscated inbox rules to hide their activity and delete security-related communications. These actions allow attackers to maintain access even after initial session tokens expire or passwords are changed.
This campaign highlights the critical limitation of traditional MFA against AitM attacks. Affected sectors face significant risks of business email compromise (BEC), payroll fraud, and sensitive data exfiltration. The urgency for organizations to transition to Phishing-Resistant MFA and implement robust Conditional Access Policies (CAP) is high.