AitM relay attacks replay M365 tokens to compromise 97 accounts at 79 orgs

1. Executive summary

Huntress tracked a Microsoft 365 token-replay campaign from 14 July to 22 September 2026 that produced 497 successful sign-ins across 79 victim organisations, with more than 200,000 failed attempts from the 193.26.115[.]0/24 block, which belongs to German hosting provider 1337 Services GmbH (AS210558). The attacker never guessed a password: adversary-in-the-middle relays, device-code phishing and social engineering during a legitimate login yielded post-MFA session tokens that were replayed at volume from attacker infrastructure, a pattern Huntress calls token spraying. In 19 organisations the victim's existing MFA methods were wiped and a new method registered within three hours of the first campaign sign-in, and at least 48 rogue devices named "DESKTOP-" plus eight hex characters were registered in victim Entra directories, so access survives a password reset unless the rogue MFA method and device are removed. No CVE is associated with this campaign and no CISA KEV entry applies; the exposure is identity-layer and affects any EMEA financial services firm running Microsoft 365 with MFA as its main control. The single-source caveat matters here: the campaign statistics, the 1337 Services attribution and the inbox-rule detail all come from Huntress, with Microsoft Entra ID Protection independently flagging the same IPs.

2. Regulatory framing

3. Technical analysis & attack chain

1. The victim is directed to a fake Microsoft sign-in page backed by an adversary-in-the-middle relay. The relay passes the genuine Microsoft login page and MFA prompt through to the victim, so the victim completes a real authentication.
2. Microsoft issues a session token after MFA completes. The relay keeps that token. Because the token is minted after the MFA step, whoever holds it does not need to pass MFA again.
3. Tokens also came from device-code phishing, where the victim is tricked into entering a code on Microsoft's legitimate sign-in page, and from social engineering during an ordinary login.
4. The attacker replays the stolen tokens from 1337 Services GmbH addresses in the 193.26.115[.]0/24 range. Huntress observed the attacker move between six addresses in that range across four phases, with breaks of a week or two between phases; blocking any single address stopped at most one phase.
5. Replay is fast. In a 21 July incident the hijacked session appeared from a 1337 Services address 12 minutes after the victim reached the MFA prompt; on 22 September the gap was four minutes. A separate 21 July timeline shows the AiTM relay at 185.238.2[.]195 catching the victim at the MFA prompt at 17:18:20 UTC, the session hijacked from 193.26.115[.]199 at 17:30:21, the same session in use from 124.198.132[.]33 at 17:43:15, and a new authenticator app labelled "iPhone 13" activated at 18:08:50.
6. Persistence is established by registering the attacker's own MFA method. In 19 organisations the victim's existing MFA methods were wiped and a new method registered within three hours of the first sign-in from a campaign address. The registered authenticator lets the attacker complete MFA for new sign-ins at will and survives a password reset unless the account's MFA methods are audited and the rogue one removed.
7. The attacker also registered at least 48 fake computers in victim Entra directories, each named "DESKTOP-" followed by eight hexadecimal characters. A registered device stays in the directory until someone deletes it, giving a more durable route back into the tenant.
8. Inbox rules named ".", "sss" and "iT" deleted incoming mail or marked it read and moved it to folders such as RSS Feeds and Conversation History. In one mailbox the attacker modified a rule to catch messages mentioning payroll, direct deposit, bank or bonus, then five minutes later created a second rule hiding all mail from an external accountant, after sending that accountant a payroll-related email from the compromised mailbox.
9. On 11 September the attacker switched to a new address and ran an automated program reusing captured tokens, completing hundreds of successful sign-ins at nearly 30 organisations over four days. The same address was blocked 1,052 times, every block from four organisations whose Conditional Access policies refused the sign-ins.

Microsoft Entra ID Protection independently raised verified threat actor IP detections against 193.26.115[.]221, [.]72, [.]16 and [.]21 in multiple customer tenants, describing the activity as consistent with known IP addresses associated with nation state actors or cyber crime groups based on Microsoft Security Intelligence. That is corroboration of the infrastructure, not of a named actor. No MITRE ATT&CK profile is available for this campaign, so attribution to any specific group is unconfirmed. Huntress is the sole source for the campaign statistics, the inbox-rule behaviour, the 48 rogue devices and the 19 MFA-replacement cases; treat those as single-sourced until verified in your own tenant telemetry. The 1337 Services GmbH hosting detail is corroborated by Microsoft's IP detections. The Krebs on Security link between the provider's founder and the Cracked forum is background context from a February 2025 article, not evidence about this campaign.

4. Mitigation & containment

P1 within 24 hours

• Query Entra sign-in logs for successful authentications from 193.26.115[.]0/24 and from 185.238.2[.]195 and 124.198.132[.]33. For every hit, pull the full session timeline and identify the source of the token.
• Audit every affected account's authentication methods. Remove any authenticator app the user did not register, including any labelled "iPhone 13" or similar device-model names. A password reset alone does not remove this access.
• List Entra registered devices matching "DESKTOP-" followed by eight hex characters and delete any not matched to a known asset record.
• Enumerate inbox rules on affected mailboxes. Remove rules named ".", "sss" or "iT", and any rule that deletes or redirects mail, marks it read, or targets keywords payroll, direct deposit, bank or bonus.
• Block 193.26.115[.]0/24, 185.238.2[.]195 and 124.198.132[.]33 at the perimeter and in Conditional Access as named locations, and revoke all refresh tokens for affected accounts.

P2 within 72 hours

• Enforce Conditional Access policies that refuse token replay: require compliant or hybrid-joined devices for M365 access, and block legacy authentication. The four organisations whose policies refused 1,052 sign-ins show this works.
• Enable and tune Entra ID Protection risk policies, including the verified threat actor IP detection, to block rather than alert on high-risk sign-ins.
• Review device-code authentication. Where the business does not need it, disable the device code flow in the tenant; where it is needed, restrict it to managed devices.
• Search mail flow and audit logs for outbound payroll-related mail to external accountants sent from compromised mailboxes, and notify the recipients.

P3 within 7 days

• Add MFA method registration and device registration to the security monitoring baseline, with alerting on new method registration within hours of a risky sign-in.
• Run a tabletop or control test against DORA Art. 24 requirements covering token theft and replay, not just credential phishing.
• Brief finance and payroll staff on device-code phishing and on social engineering during a legitimate login, since those were token sources in this campaign.

5. Indicators of compromise

ipv4  193.26.115[.]0/24
ipv4  193.26.115[.]221
ipv4  193.26.115[.]72
ipv4  193.26.115[.]16
ipv4  193.26.115[.]21
ipv4  193.26.115[.]199
ipv4  185.238.2[.]195
ipv4  124.198.132[.]33

Behavioural indicators

6. Detection

title: M365 Token Replay Rogue MFA and Inbox Rule Activity
id: 7c1e4a92-3b6d-4f18-9a2e-5d0c8b1f6e34
status: experimental
description: Detects rogue authenticator registration, DESKTOP- device enrolment and suspicious inbox rule creation consistent with the Huntress token-replay campaign.
author: Adverse Trace
date: 2026-10-26
references:

  - https://www.huntress.com/blog/token-replay-spray
logsource:
  product: azure
  service: auditlogs
detection:
  selection_mfa:
    OperationName: 'Update user.'
    ModifiedProperties|contains: 'StrongAuthenticationMethod'
  selection_device:
    OperationName: 'Add device.'
    DeviceDisplayName|startswith: 'DESKTOP-'
  selection_rule:
    OperationName: 'New-InboxRule'
    Parameters|contains:

      - 'RSS Feeds'
      - 'Conversation History'
      - 'payroll'
      - 'direct deposit'
  condition: selection_mfa or selection_device or selection_rule
falsepositives:

  - Legitimate device enrolment during onboarding
  - User-created inbox rules for mail triage
level: high

title: M365 Sign-In From 1337 Services GmbH Address Range
id: 2f8b6d10-9c47-4e21-b3a5-6e9d0c4a7b18
status: experimental
description: Detects successful M365 sign-ins from the 193.26.115.0/24 block and related campaign addresses.
author: Adverse Trace
date: 2026-10-26
references:

  - https://www.huntress.com/blog/token-replay-spray
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    Status: 'Success'
    IPAddress|cidr:

      - '193.26.115.0/24'
  selection_extra:
    IPAddress:

      - '185.238.2.195'
      - '124.198.132.33'
  condition: selection or selection_extra
falsepositives:

  - Legitimate users on 1337 Services GmbH hosting (unlikely for enterprise staff)
level: high

7. Sources

• Huntress, "M365 Token Spray and Replay Campaign Compromises Business Email Accounts", https://www.huntress.com/blog/token-replay-spray, 2026.
• Help Net Security, "Microsoft 365 accounts compromised at 79 organizations, no passwords needed", https://www.helpnetsecurity.com/2026/10/23/microsoft-365-accounts-stolen-sessions/, 2026-10-23.
• The Hacker News, "Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations", https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html, 2026-10-26.
• The Hacker News, "Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails", https://thehackernews.com/2026/08/microsoft-365-aitm-phishing-hijacks.html, 2026-08.
• The Hacker News, "Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks", https://thehackernews.com/2026/09/microsoft-365-attackers-use-help-desk.html, 2026-09.
• Help Net Security, "Attackers are using Microsoft's legitimate login system to camouflage phishing attacks", https://www.helpnetsecurity.com/2026/07/30/microsoft-authentication-system-phishing/, 2026-07-30.
• The Hacker News, "Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows", https://thehackernews.com/2026/08/mirage2fa-surge-hits-4500-us-and-eu.html, 2026-08.

8. Adverse Trace position

Adverse Trace assesses this as a high-impact identity compromise with no CVE and no CISA KEV entry, so severity rests on the persistence mechanism rather than on a patchable flaw: rogue MFA methods and registered devices outlive the stolen session and survive a password reset. The campaign statistics and behavioural detail are single-sourced to Huntress, with Microsoft Entra ID Protection independently corroborating the 1337 Services GmbH IP infrastructure; no named actor is confirmed and no MITRE ATT&CK profile exists for this activity. EMEA financial services clients running Microsoft 365 should treat the P1 account and mailbox audit as mandatory this week, because the 19 MFA-replacement cases and 48 rogue devices mean a password reset alone leaves the attacker in place. Adverse Trace will monitor for further reporting on the 1337 Services GmbH infrastructure and will update this advisory if Microsoft publishes its own campaign telemetry or if additional victim organisations are named.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.