A Microsoft 365 campaign compromised business email accounts at 79 organizations by replaying stolen authentication tokens rather than guessing passwords, according to new research from Huntress.
Researchers identified 497 successful sign-ins and more than 200,000 failed attempts during the campaign, which operated between July 14 and September 22, 2026. Attackers registered rogue devices, replaced victims’ multifactor authentication methods and created hidden inbox rules to conceal fraudulent communications.
Huntress calls the technique “token spraying” because the attackers systematically replayed stolen tokens across numerous organizations, much like password spraying but without needing to know the victims’ passwords.
ATTACKERS STOLE SESSIONS AFTER VICTIMS COMPLETED MFA
Many victims encountered adversary-in-the-middle phishing pages that relayed the genuine Microsoft sign-in page and MFA request.
When a victim supplied credentials and approved the authentication request, Microsoft issued a valid session token. The malicious relay captured that token and allowed the attacker to reuse the authenticated session from a separate system.
Because the token was created after the victim passed MFA, the attacker could access Microsoft 365 without completing another MFA challenge.
Huntress also traced stolen tokens to device-code phishing and social engineering conducted during legitimate sign-in processes.
This activity does not mean that Microsoft’s MFA cryptography was broken. Instead, attackers stole the proof that authentication had already occurred.
STOLEN SESSIONS WERE REPLAYED WITHIN MINUTES
The campaign used infrastructure associated with German hosting provider 1337 Services GmbH, also known as AS210558. Huntress traced more than 200,000 failed attempts to the 193.26.115.0/24 address range.
In one incident on July 21, an attacker replayed the captured session 12 minutes after the victim reached the MFA prompt. On September 22, the delay was only four minutes.
The operators rotated among six addresses in the range and conducted activity in several phases. This reduced the value of blocking a single IP address and suggests that the campaign incorporated automated token-replay capabilities.
Microsoft Entra ID Protection independently flagged several campaign addresses as verified threat-actor infrastructure in multiple customer tenants.
ATTACKERS REGISTERED ROGUE DEVICES AND REPLACED MFA METHODS
After entering victim accounts, the attackers established access that could survive the expiration of the original stolen session.
Huntress found at least 48 unauthorized computers registered in victims’ Entra directories. The devices used names beginning with “DESKTOP-” followed by eight hexadecimal characters.
Registered devices remain in an organization’s directory until an administrator removes them. Depending on Conditional Access rules and device trust configurations, enrollment may also help attackers appear more legitimate or satisfy access requirements.
At 19 organizations, attackers deleted victims’ existing MFA methods and registered replacements within three hours of the initial malicious sign-in.
In one case, an authenticator labeled “iPhone 13” was activated less than an hour after the session was stolen. Once attackers control an MFA method, they can complete future authentication requests independently.
A password reset alone may therefore fail to remove them.