Huntress: an attacker replayed stolen Microsoft 365 sign-in sessions to break into email accounts at 79 organisations over ten weeks without needing passwords, then registered rogue devices and new MFA methods and hid mail with inbox rules (via Help Net Security)
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organisations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Help Net Security, reporting research by Huntress. Huntress tracked the campaign between 14 July and 22 September 2026, counting 497 successful sign-ins and more than 200,000 failed login attempts, and the stolen sessions were replayed from servers at 1337 Services GmbH, a hosting provider incorporated in Hamburg, Germany, according to Help Net Security.
Huntress says victims landed on fake sign-in pages backed by adversary-in-the-middle (AiTM) relays that passed the real Microsoft login page and MFA prompt through while keeping the session token issued after sign-in, which can be used without passing MFA again; other tokens came from device-code phishing and social engineering, according to Help Net Security. Huntress calls the bulk replay of stolen tokens from one block of addresses 'token spraying', and says the attacker moved between six addresses in the 193.26.115.0/24 range in four phases, according to Help Net Security.
Once inside, Huntress found at least 48 rogue computers registered in victims' Microsoft Entra directories, each named 'DESKTOP-' followed by eight hexadecimal characters, and in 19 organisations the victim's existing MFA methods were wiped and a new one registered within three hours of the first sign-in from a campaign address, according to Help Net Security. Inbox rules with names such as '.', 'sss' and 'iT' deleted incoming mail or moved it to folders such as RSS Feeds and Conversation History; in one case a compromised mailbox was used to send a payroll-related email to an external accountant, according to Help Net Security.
From 11 September an automated program reusing captured tokens completed hundreds of successful sign-ins at nearly 30 organisations over four days, and every one of the 1,052 blocks of that address came from four organisations whose Conditional Access policies refused the sign-ins, according to Help Net Security.
- Product
- Microsoft 365 / Microsoft Entra ID accounts (identity abuse)
- Versions
- n/a — stolen session tokens, no software flaw
- Exploited in Australia?
- unknown
- Patch to
- According to Help Net Security, Huntress says Conditional Access policies, which can require MFA or block access outright, can fill some of the security gaps MFA can't. Check Entra ID for unfamiliar registered devices (Huntress saw names of the form 'DESKTOP-' plus eight hexadecimal characters; a registered device stays until someone deletes it) and for newly registered authenticator methods, which survive a password reset unless someone audits the account and removes them; review mailboxes for hidden inbox rules. Huntress has published mitigation guidance and indicators of compromise in its blog post, according to Help Net Security.