Token spray and replay campaign compromises M365 accounts at 79 organizations via 1337 Services GmbH infrastructure
Between July 14 and September 22, 2026, Huntress detected 497 Microsoft 365 sign-in events across 79 victim organizations in a token replay campaign. The attacker replayed post-MFA session tokens stolen through AiTM relays, device-code phishing and social engineering, a pattern Huntress calls "token spraying". Replay traffic came from the…