Token-spraying campaign replays post-MFA tokens to compromise 97 Microsoft 365 accounts at 79 organizations via 1337 Services GmbH

Linha do tempo

1. gbhackers.com ↗ · pub. 27/10/2026 03:47 · coletado 27/10 05:00

   Token replay campaign hits 79 Microsoft 365 tenants via AiTM phishing, rogue Entra devices and MFA swaps

   ler a análise desta fonte ocultar

   Huntress reports a ten-week token replay campaign (July 14 to September 22, 2026) that compromised Microsoft 365 environments at 79 organizations. The operators used adversary-in-the-middle (AiTM) phishing to capture authenticated sessions after victims completed MFA, then replayed those sessions without needing passwords or a fresh MFA challenge. Huntress logged 497 successful sign-ins and more than 200,000 failed attempts, and describes the activity as "token spraying". Attackers then persisted by registering rogue devices and MFA methods and used mailbox rules to support business email compromise (BEC).

   Technical Details

   • Initial access: AiTM phishing through relayed Microsoft sign-in pages. Device-code phishing and social engineering during legitimate authentication were also observed. No malware was needed.
   • Replay tooling: Huntress identified two toolsets. One used scripted OAuth2:Token requests, often with a node user agent, against Microsoft Graph, Exchange Online, SharePoint Online and Device Registration Service. The other replayed browser sessions through Chrome or Edge against OfficeHome and Exchange Online.
   • Example timeline (July 21): A victim reached an MFA prompt via relay 185.238.2[.]195 at 17:18 UTC. Twelve minutes later the hijacked session appeared from 193.26.115[.]199. By 18:08 an authenticator named "iPhone 13" had been registered.
   • Persistence: At least 48 rogue Entra devices were registered, named DESKTOP- followed by eight uppercase hex characters. Existing MFA methods were removed and replaced within three hours of initial access at 19 organizations.
   • Infrastructure: Replay traffic mainly came from 193.26.115[.]0/24, associated with German hosting provider 1337 Services GmbH (AS210558). Separate relays handled phishing capture. Use of this provider's network does not establish its involvement in the attacks.
   • BEC activity: Inbox rules marked messages as read, deleted them, or moved them to folders such as "RSS Feeds" and "Conversation History". In one case a compromised account sent a payroll-related message to an external accountant while rules hid the replies. The malicious inbox rules came from other hosting or VPN networks, so blocking the main replay range alone is not enough.

   Remediation

   • Revoke compromised sessions, reset passwords, review registered devices and MFA methods, and remove unauthorized inbox rules. A password reset alone does not remove attacker-controlled authenticators or rogue devices.
   • Correlate successful hosting-origin sign-ins with authentication changes, device registration and mailbox activity, rather than focusing on failed-login volume.
   • Make Conditional Access policies cover all relevant users, applications, client types and authentication flows. Restrict unnecessary device-code authentication and investigate unusual token requests involving user mailboxes.
2. thehackernews.com ↗ · pub. 26/10/2026 05:35 · coletado 26/10 07:00

   Microsoft 365 token-spraying campaign uses AitM relays to compromise 97 accounts at 79 organizations

   ler a análise desta fonte ocultar

   Huntress disclosed a campaign, observed from July 14 to September 22, 2026, in which attackers used adversary-in-the-middle (AitM) phishing pages to steal Microsoft 365 session tokens and replay them against email accounts at 79 organizations. Of more than 200,000 login attempts traced to the 193.26.115[.]0/24 range, 497 sign-ins succeeded, 97 accounts were compromised and 48 rogue Entra devices were registered. Huntress calls the technique "token spraying" because many stolen tokens are replayed at scale across tenants, much like password spraying. The attackers then persisted by registering their own authenticator apps and devices, and hid their activity with inbox rules. The infrastructure is tied to the German hosting provider 1337 Services GmbH, which is linked to StarkRDP and rdp[.]sh.

   Technical Details

   • The AitM login page sits between the victim and the real Microsoft login, captures credentials and MFA codes and relays them. The attacker keeps the issued access token so they do not need to defeat MFA a second time.
   • Tokens are replayed from attacker devices within minutes for automated sign-ins. Huntress says tokens came from AitM relays, device-code phishing and social engineering during legitimate logins.
   • Persistence: at least 19 organizations had existing MFA methods removed and a new one registered within three hours of the first sign-in. In one case on July 21, 2026, an authenticator app named "iPhone 13" was added less than 51 minutes after the hijack. At least 48 fake devices were registered in victim directories, giving a more durable way to request tokens.
   • Defense evasion: hidden inbox rules named ".,", "sss", "ss", "iT", ",.,", "........", "s" and "d" delete or move mail mentioning payroll, deposit and bonus into folders such as RSS Feeds and Conversation History. One mailbox was used to send spam to hundreds of external recipients before Entra ID Protection rated it high risk.
   • Infrastructure: the campaign was first seen from the Romanian IP 193.26.115[.]221, which VirusTotal associates with AsyncRAT. GreyNoise lists 29 IPs for the hosting provider, 10 malicious and 5 suspicious. StarkRDP and rdp[.]sh were disrupted in the January 2025 Operation Talent, and the services are reportedly operating again, with one rebranded as exy[.]sh.

   Remediation

   • Revoke sessions and reset passwords for suspected compromises.
   • Audit Entra devices and review registered MFA methods.
   • Check for unexpected inbox rules and new enterprise applications.
   • Restrict the device-code flow with Conditional Access policies, and require MFA (or block) for all users, all cloud apps and all client app types.
3. infosecurity-magazine.com ↗ · pub. 23/10/2026 07:30 · coletado 23/10 09:01

   Token-spraying AiTM campaign hits Microsoft 365 tenants with 200,000+ login attempts, 497 successful, setting up BEC

   ler a análise desta fonte ocultar

   Researchers at Huntress uncovered a global business email compromise (BEC) staging campaign against Microsoft 365 environments. Between July and September 2026 it affected 79 Huntress customer organizations. The actor used fake sign-in pages, device-code phishing, adversary-in-the-middle (AiTM) techniques and social engineering to steal session tokens issued after a successful MFA check. It then replayed those tokens in automated "token-spraying" logins. Huntress observed at least 200,000 login attempts, 497 of them successful, with attackers often inside tenants within minutes of stealing a token. Huntress published its findings on October 22.

   Technical Details

   • Stolen tokens are generated after the legitimate login and MFA verification, so replaying them bypasses MFA and requires no password.
   • After access, the attackers wiped victims' MFA settings and registered their own phone or authenticator, so a password reset alone would not evict them.
   • They created hidden inbox rules that moved messages from specific contacts out of sight.
   • They modified Entra settings to register their own devices as legitimate, allowing them to request new tokens later.
   • In one case a compromised mailbox was used to send a payroll-related phishing email; no payment appears to have been received.
   • The article names no threat actor, IOCs or CVEs.

   Remediation

   • Configure Conditional Access Policies to require MFA (or block) for All Users, All Cloud Apps and All Client App types, unconditionally (Huntress).
   • If token replay is suspected, revoke sessions and reset the password.
   • Audit Entra registered devices and MFA methods.
   • Review inbox rules for unauthorized changes.
4. huntress.com ↗ · pub. 22/10/2026 10:00 · coletado 22/10 11:01 primeiro registro

   Token spray and replay campaign compromises M365 accounts at 79 organizations via 1337 Services GmbH infrastructure

   ler a análise desta fonte ocultar

   Between July 14 and September 22, 2026, Huntress detected 497 Microsoft 365 sign-in events across 79 victim organizations in a token replay campaign. The attacker replayed post-MFA session tokens stolen through AiTM relays, device-code phishing and social engineering, a pattern Huntress calls "token spraying". Replay traffic came from the 193.26.115[.]0/24 block hosted by German provider 1337 Services GmbH (AS210558), with more than 200,000 failed login attempts traced to the range. After takeover, the actor wiped and re-registered MFA methods, registered at least 48 rogue Entra devices and created hidden inbox rules. In at least one case they sent a payroll-related email to an external CPA. Microsoft Entra ID Protection independently flagged several of the same IP addresses.

   Technical Details

   • Two-tier infrastructure: AiTM relays (e.g. 185.238.2[.]195, and an Evoxt Sdn. Bhd. relay) capture the session at the MFA prompt. The session then reappears from a 1337 Services address within 4 to 12 minutes.
   • Build A (scripted replay): node or bare Mozilla/5.0 user agent, OAuth2:Token requests using the Microsoft Office and Microsoft Authentication Broker client IDs against Graph, Exchange Online, SharePoint Online and the Device Registration Service. Each sign-in registered a rogue Entra-joined device named DESKTOP- plus 8 uppercase hex characters (48 distinct devices).
   • Build B (browser session replay): current Chrome/Edge on Windows replaying sessions from AiTM relays against OfficeHome and Exchange Online.
   • Phases:
     • Phase 1 (Jul 14 to Aug 3, [.]221 and [.]199): 37 organizations compromised and 37 rogue devices registered.
     • Phase 2 (from Aug 17, [.]16 and [.]21): device-code phishing, MFA wipe and re-registration, lookalike partner domain.
     • Phase 3 (Sep 11 to 15, [.]72): 303 successful sign-ins across 29 organizations, plus 1,052 sign-ins blocked by Conditional Access in just four organizations.
     • Phase 4 (Sep 2 to 22, [.]210): relay and replay pairing.
   • Persistence: in 19 organizations, existing MFA methods were wiped and a new authenticator (labeled "iPhone 13" in one case) was registered within three hours. Rogue devices give durable token-request capability.
   • Inbox rules: rules named ., sss, s and d moved or deleted mail to folders such as RSS Feeds or Conversation History, keyed on payroll, direct deposit, bank or bonus terms. They were created from VPN or rented hosting (ExpressVPN, NordVPN, CrownCloud, DataWagon, GLOBALTELEHOST, LeaseWeb, Dynu, Interserver), never from 1337 Services, and in four mailboxes via the Outlook REST API.
   • Replays of revoked sessions failed with AADSTS50133 (SsoArtifactRevoked). AADSTS53003 blocks indicate a valid credential.
   • Huntress notes that a 2025 Krebs on Security article suggested the 1337 Services founder may have operated the Cracked forum. No actor attribution is made.

   Remediation

   • Revoke sessions and reset passwords. A reset alone removes neither rogue devices nor MFA methods, and the access token lives about 90 minutes.
   • Audit Entra devices (DESKTOP-, Device- or Work Pc plus 8 hex characters) and MFA methods, removing unrecognized ones.
   • Review inbox rules with short or punctuation-only names or payroll and banking keywords.
   • Enforce Conditional Access requiring MFA or block for all users, cloud apps and client app types. Restrict device-code flow. Treat AADSTS53003 blocks as evidence of a valid credential.
   • Prioritize response by credential validity, not spray volume.
   • Hunt for OAuth2:Token and Cmsi:Cmsi sign-ins from hosting infrastructure with node or bare Mozilla/5.0 user agents, and for new enterprise applications. Consider blocking the full 193.26.115[.]0/24.