Microsoft 365 token replay attacks compromise 97 accounts

Cybersecurity researchers have disclosed a Microsoft 365 operation in which adversaries used an adversary-in-the-middle relay to capture sign-in sessions and replay stolen tokens, enabling access to email accounts across 79 organisations. Huntress tracked activity from 14 July to 22 September 2026, recording 497 successful sign-in events from more than 200,000 login attempts, with 97 accounts compromised and 48 rogue Entra devices registered.

The attackers did not brute-force passwords; instead, they replayed tokens obtained during victims’ sign-ins, using more than 200,000 failed login attempts attributable to the same campaign window from the 193.26.115[.]0/24 IP range.

The attackers employed an AitM login page to intercept credentials and MFA codes, then relayed them to the real login page to obtain an access token. The goal was to replay the Microsoft-issued access token from the attackers’ devices within minutes, enabling automated sign-ins to Microsoft 365 services.

The campaign also pursued persistence: attackers added their own authenticator app and/or rogue devices, with at least 48 fake computers registered in victim directories, to sustain access even if the original session token expired or was revoked. In at least 19 organisations, legitimate MFA methods were removed and new methods registered within three hours of initial sign-in; in one July 2026 case, an authenticator named “iPhone 13” was activated within 51 minutes of hijack.

Investigators also observed hidden inbox rules and other manipulation to misdirect or suppress emails, including payroll-related keywords and spam activity from compromised mailboxes. The attack surface includes sign-in tokens from multiple sources—AitM relays, device-code phishing, and social engineering during legitimate logins.

Authorities advise revoking sessions, resetting passwords, auditing Entra devices, reviewing MFA methods, and tightening Conditional Access policies to require MFA for all users, all cloud apps, and all client app types.