Cybersecurity
Microsoft 365 token replay hit 97 accounts at 79 organisations
Huntress said a token replay campaign ran from July to September 2026, using adversary-in-the-middle login pages and stolen sign-in tokens to compromise Microsoft 365 accounts at 79 organisations.
- Huntress said it observed the campaign between 14 July and 22 September 2026.
- It said the activity produced 497 successful Microsoft 365 sign-ins, 97 compromised accounts and 48 rogue Entra devices.
- Researchers said attackers used adversary-in-the-middle pages to capture credentials, MFA codes and issued access tokens before replaying them.
- Huntress said 193.26.115[.]0/24 accounted for more than 200,000 failed login attempts across the campaign window.
Huntress said the campaign targeted Microsoft 365 accounts at 79 organisations and relied on token replay rather than password guessing. The firm said it saw 497 successful sign-ins across the victim organisations and 97 compromised accounts.
The researchers said the attackers used a login page placed between victims and Microsoft services to collect credentials, multi-factor codes and the resulting access token. They said the token was then reused from the attackers' own devices within minutes, a method they called token spraying.
After gaining access, the attackers added their own authenticator app to maintain entry and handle later sign-ins. In at least 19 organisations, existing MFA methods were removed and a new one was registered within three hours of the first sign-in.
Huntress said one case on 21 July 2026 saw a new authenticator app called iPhone 13 activated within 51 minutes of the hijack. It also said the attackers created at least 48 fake computers in Microsoft directories and set inbox rules to hide or delete selected mail.
The firm said the campaign began from 193.26.115[.]221, which VirusTotal linked to AsyncRAT and which it said was associated with 1337 Services GmbH. GreyNoise listed 29 related IP addresses, 10 marked malicious and five marked suspicious.
Named in this story
People
- Andrea Hatcher
- was one of the Huntress researchers quoted
- Susannah Matt
- was one of the Huntress researchers quoted
- Matt Poto
- was one of the Huntress researchers quoted
- Andrew Schwartz
- was one of the Huntress researchers quoted
Companies
- Huntress
- observed the campaign and published the findings
- VirusTotal
- was cited for associating an IP address with AsyncRAT
- 1337 Services GmbH
- was the German hosting provider associated with the IP address
- GreyNoise
- listed related IP addresses and their risk labels
- StarkRDP
- was linked to the hosting provider and denied involvement in alleged crimes
Products and systems
- Microsoft 365
- was the service targeted by the campaign
- Microsoft Entra ID Protection
- rated one compromised account as high risk
- AsyncRAT
- was the remote access trojan linked to the Romanian IP address
- rdp[.]sh
- was a service tied to StarkRDP that lets customers rent virtual servers
How the source tells it
The article was mostly straight technical reporting, with mild urgency created by repeated counts of failed logins, compromised accounts and rogue devices.
- urgency repeated tallies of failed logins, compromised accounts and rogue devices