---
title: 'Microsoft 365 token replay campaign compromises 79 organizations with 497 successful sign-ins'
url: 'https://securteksecurity.com/news/microsoft-365-token-replay-campaign-79-organizations-497-sign-ins'
markdown: 'https://securteksecurity.com/news/microsoft-365-token-replay-campaign-79-organizations-497-sign-ins.md'
date: '2026-10-23'
description: 'Huntress reports that between July 14 and September 22, 2026, an attacker replayed stolen Microsoft 365 session tokens to sign in at 79 organizations, with 497 successful sign-ins counted against more than 200,000 failed attempts. The tokens were taken through adversary in the middle relays behind …'
taxonomy:
  category:
    - Cybersecurity
---

# [Microsoft 365 token replay campaign compromises 79 organizations with 497 successful sign-ins](https://securteksecurity.com/news/microsoft-365-token-replay-campaign-79-organizations-497-sign-ins)

   23rd Oct 2026  

Huntress reports that between July 14 and September 22, 2026, an attacker replayed stolen Microsoft 365 session tokens to sign in at 79 organizations, with 497 successful sign-ins counted against more than 200,000 failed attempts. The tokens were taken through adversary in the middle relays behind fake sign-in pages, device code phishing and social engineering during legitimate sign-ins. Because the tokens are issued after multifactor authentication, whoever holds one needs no password and no second MFA pass. The replays came mainly from the 193.26.115\[.\]0/24 range at 1337 Services GmbH, and Microsoft Entra ID Protection independently flagged several of those addresses.

To keep access after a stolen session expired, the attacker registered at least 48 rogue devices in victim Entra directories and, in 19 organizations, wiped the victim's existing MFA methods and registered a new one within three hours of the first campaign sign-in. Hidden inbox rules moved or deleted selected messages, and in one case a compromised mailbox was used to send a payroll related email to an outside accountant. Huntress advises revoking sessions and resetting passwords, then auditing and removing unrecognized devices and MFA methods and reviewing inbox rules, because a password reset alone does not remove the rogue devices or methods.

Sources: [Huntress](https://www.huntress.com/blog/token-replay-spray); [Help Net Security](https://www.helpnetsecurity.com/2026/10/23/microsoft-365-accounts-stolen-sessions/); [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/tokenspraying-attacks-target/)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [Meta to raise up to $95 billion in new stock to pay for its AI buildout](https://securteksecurity.com/news/meta-raise-95-billion-stock-ai-buildout.md)
- Next: [Microsoft and Health-ISAC take down phishing kit marketplaces behind more than a billion malicious messages](https://securteksecurity.com/news/microsoft-health-isac-phishing-kit-marketplaces-takedown.md)