A token replay attack campaign exploited Microsoft 365 sign-in sessions to access accounts at 79 organisations, new research from Huntress and Microsoft Entra ID Protection shows. Between 14 July and 22 September 2026, attackers used adversary-in-the-middle (AiTM) relays to obtain session tokens after users passed MFA, then replayed those tokens from rented infrastructure, bypassing MFA in subsequent logins. Some tokens were also obtained via device-code phishing.
In one case the time from token capture to replay was as short as four minutes, and attackers even used tokens from a German hosting provider, 1337 Services GmbH. Huntress describes this pattern as “token spraying,” akin to password spraying but using stolen tokens instead of passwords.
Detailed activity indicates the attackers registered at least 48 rogue devices under victims’ Entra directories, with device names crafted to resemble ordinary Windows PCs. In 19 organisations, MFA methods were wiped and a new authenticator added within three hours, allowing MFA bypass to persist even after password resets.
The attackers also planted hidden inbox rules with very short names to divert or hide mail—one case moved payroll-related messages to obscure folders and targeted a contact outside the organisation for payroll-related fraud. Across the campaign, there were 497 successful sign-ins and more than 200,000 failed attempts; a four-day burst saw a single address tally 303 successful sign-ins across 29 organisations. Conditional Access blocked 1,052 additional attempts, but these came from only four organisations.
No attribution for the operator has been confirmed publicly; Huntress notes Microsoft Entra ID Protection flagged replay addresses and suggested links to nation-state actors or cybercrime groups, though no formal claim has been made. Recommended mitigations focus on strict MFA enforcement, session revocation, device auditing, scrutinising rapid MFA method changes, reviewing unusual inbox rules, and restricting device-code sign-in flows.