Microsoft 365 token replay campaign compromises 79 organizations with 497 successful sign-ins

Huntress reports that between July 14 and September 22, 2026, an attacker replayed stolen Microsoft 365 session tokens to sign in at 79 organizations, with 497 successful sign-ins counted against more than 200,000 failed attempts. The tokens were taken through adversary in the middle relays behind fake sign-in pages, device code phishing and social engineering during legitimate sign-ins. Because the tokens are issued after multifactor authentication, whoever holds one needs no password and no second MFA pass. The replays came mainly from the 193.26.115[.]0/24 range at 1337 Services GmbH, and Microsoft Entra ID Protection independently flagged several of those addresses.

To keep access after a stolen session expired, the attacker registered at least 48 rogue devices in victim Entra directories and, in 19 organizations, wiped the victim's existing MFA methods and registered a new one within three hours of the first campaign sign-in. Hidden inbox rules moved or deleted selected messages, and in one case a compromised mailbox was used to send a payroll related email to an outside accountant. Huntress advises revoking sessions and resetting passwords, then auditing and removing unrecognized devices and MFA methods and reviewing inbox rules, because a password reset alone does not remove the rogue devices or methods.

Sources: Huntress; Help Net Security; Infosecurity Magazine