Ace Security Desk – Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations according to THN: Published: Oct.26 2026
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
“Rather than guessing passwords, the attacker replayed sign-in tokens stolen from victims, and we’ve traced more than 200,000 failed login attempts from the campaign window back to the 193.26.115[.]0/24 IP range,” Huntress researchers Andrea Hatcher, Susannah Matt, Matt Poto, and Andrew Schwartz said.
The attack has been found to employ an AitM login page, which sits between the victims and legitimate Microsoft infrastructure to capture the entered credentials and MFA codes and relay the information to the real login page.
The end goal is to collect the access token issued by Microsoft following the sign-in process so that it doesn’t have to bypass MFA a second time. The “proof of login” token is subsequently replayed by the attacker from their own devices within minutes to conduct automated sign-in attempts against Microsoft 365 services.
The approach has been codenamed token spraying, as it involves the attacker replaying many stolen tokens at scale across several organizations in a manner that’s analogous to password spraying.
Upon gaining successful access, the attackers moved to add their own authenticator app as a form of persistence to complete MFA challenges for new sign-ins and overcome scenarios where the stolen session token expires or gets revoked by the victim.
In no less than 19 organizations, the victim’s existing MFA methods were removed and a new method registered within three hours of the first sign-in. In one case observed on July 21, 2026, the threat actors activated a new authenticator app named “iPhone 13” less than 51 minutes after the session was hijacked.
“Rogue devices served the same purpose,” the researchers said. “The threat actor registered at least 48 fake computers in victim organizations’ Microsoft directories. A registered device can give the attacker a more durable way to request tokens than the stolen session alone, and it stays in the directory until someone deletes it.”
Furthermore, the attackers have also been spotted setting up hidden email rules in victims’ inboxes with names such as “.,” “sss,” “ss,” “iT,” “,.,” “……..,” “s,” and “d” to delete incoming mail with certain keywords referencing payroll, deposit, and bonus, or move them to obscure folders like RSS Feeds and Conversation History.
In one compromised mailbox, the email rule marked all incoming messages as read and deleted them. The mailbox was then used to send outbound spam to hundreds of external recipients before Microsoft Entra ID Protection rated the account high risk.
At Sterling Publishing & Media Service Agency, we prioritise transparency and accountability in all our operations. We wish to clarify that we are not responsible for any external content, hyperlinks, or costs associated with our services. Nevertheless, we remain committed to delivering outstanding services and greatly value your continued support. Thank you for your trust in us.
