Huntress has detailed a Microsoft 365 campaign that skips passwords entirely. The attacker replays session tokens that were issued after MFA, and Huntress calls the technique token spraying.
Huntress says it responded to related incidents at 79 organizations. It counted at least 497 successful sign-ins against more than 200,000 failed attempts. The activity was first detected on July 14, 2026, and the sign-in count runs through September 22. Help Net Security covered the report on October 23.
Tokens were obtained through adversary-in-the-middle relays and through device-code phishing. A relay proxies the real Microsoft login page and MFA prompt, then keeps the token Microsoft issues afterward. Replaying that token looks like a legitimate, already-authenticated session.
According to Huntress, the attacker registered at least 48 rogue Entra devices, wiped and replaced victims' MFA methods, and created inbox rules to hide malicious messages. The main replay hosts sat in 193.26.115.0/24, operated by 1337 Services GmbH (AS210558), a hosting provider in Hamburg. The operators have not been identified.
Why it matters: MFA alone does not stop this. Once a token is stolen, the attacker inherits the session, then persists by enrolling devices and swapping authentication methods.
Mitigation. Hunt for sign-ins from 193.26.115.0/24 and AS210558. Review recent Entra device registrations and MFA method changes, especially several devices registered by one user. Audit mailboxes for new inbox rules that hide or delete mail. Block or restrict device-code flow with Conditional Access. Prefer phishing-resistant MFA and token-bound sessions where available. Revoke sessions for any account that shows these signs.
