Huntress Details M365 Token-Replay Campaign Affecting 79 Organizations

Oct 22, 2026 · Original article ↗

Summary

Huntress reports a 10-week Microsoft 365 token-replay campaign affecting 79 organizations, with at least 497 successful sign-ins. Attackers stole sessions through AiTM relays and other methods, then registered rogue devices, changed MFA and hid emails.

Key points

From July 14 to September 22, 2026, Huntress observed at least 497 successful sign-ins across 79 organizations, alongside more than 200,000 failed attempts.
The attackers obtained tokens through AiTM relays, device-code phishing and social engineering during legitimate sign-ins, then replayed them from hosting infrastructure including 193.26.115[.]0/24.
The investigation identified two replay toolsets and rotating infrastructure. Blocking a single IP address would not have covered all six main replay hosts.
Attackers registered at least 48 rogue Entra devices. In 19 organizations, existing MFA methods were wiped and a new method registered within three hours of the first campaign sign-in.
Hidden inbox rules moved or deleted selected messages; in one incident, an attacker used a compromised mailbox to send a payroll-related email to an outside contact.
Huntress recommends revoking sessions and resetting passwords, then auditing and removing unrecognized devices and MFA methods. A password reset alone may leave attacker access in place.
Conditional Access blocked sign-ins from one campaign address in four organizations, while the article says the same campaign also succeeded in other organizations.

Article Details

Attack Vectors: Adversary-in-the-middle relays presented fake sign-in pages and captured victims' session tokens after they completed MFA.
Device-code phishing tricked victims into entering codes on Microsoft's legitimate sign-in page, authorizing attacker sessions.
Stolen Microsoft 365 tokens were replayed from rented hosting infrastructure in automated sign-in attempts.
The attacker cleared and replaced victims' MFA methods and registered rogue Entra devices to maintain access.
The attacker created inbox rules to hide or delete messages and used a compromised mailbox for spam and a payroll-related email.
Defensive Notes: Configure Conditional Access to require MFA or block access for all users, cloud apps, and client app types.
For suspected compromise, revoke sessions and reset the password; also remove attacker-registered devices and unrecognized MFA methods.
Audit Entra devices, MFA changes, and inbox rules, including rules with short or punctuation-only names and rules moving messages to obscure folders.
Restrict device-code flow with Conditional Access authentication-flow policies.
Investigate sign-ins from hosting infrastructure using OAuth2:Token or Cmsi:Cmsi, especially those involving user mailboxes or the Device Registration Service.
Treat Conditional Access blocks as evidence of valid credentials and prioritize investigations based on credential validity rather than failed-attempt volume.
Disable standard-user consent to new applications or require users to request application access.

Indicators of compromise

Type	Indicator	Context
IPV4	`124[.]198[.]132[.]33`	Campaign infrastructure used to continue a hijacked session.
IPV4	`167[.]148[.]41[.]96`	Interserver address used to create inbox rules hiding responses to a payroll-related email.
IPV4	`185[.]238[.]2[.]195`	Adversary-in-the-middle relay that captured a victim's session during the July 21 incident.
IPV4	`192[.]159[.]99[.]172`	Campaign infrastructure used in a failed attempt to replay a stolen session.
IPV4	`193[.]26[.]115[.]16`	Campaign host used for token replay and device-code phishing.
IPV4	`193[.]26[.]115[.]199`	Build B session-replay host used during Phase 1 and later failed token-replay attempts.
IPV4	`193[.]26[.]115[.]21`	Build A token-replay host that targeted SharePoint Online.
IPV4	`193[.]26[.]115[.]210`	Build B session-replay host used during Phase 4.
IPV4	`193[.]26[.]115[.]221`	Build A token-replay and rogue-device-registration host used during Phase 1.
IPV4	`193[.]26[.]115[.]72`	Automated token-replay host used in the September campaign burst.
IPV4	`45[.]83[.]31[.]44`	Campaign infrastructure used in a failed attempt to replay a stolen session.
IPV6	`2400:8d60:2::1:841d:5dd`	Evoxt relay used to capture a victim's session during Phase 4.