As reported by The Hacker News, Huntress has documented a sustained Microsoft 365 token-replay campaign running from July through September 2026, compromising 97 accounts across 79 organizations and registering 48 rogue Entra devices. The campaign, which the researchers dubbed "token spraying," leveraged adversary-in-the-middle (AitM) infrastructure to harvest session tokens at scale — then replayed them across hundreds of thousands of automated sign-in attempts from a single IP range (193.26.115.0/24).
The Core Problem: MFA Is Not Identity Assurance
This campaign reinforces a reality that many organizations still resist: multi-factor authentication confirms a login attempt, not the identity or intent of the person behind it. AitM proxies sit between the user and Microsoft's authentication endpoints, capturing credentials, relay MFA challenges transparently, and exfiltrate the resulting session token. Once the attacker holds that token, MFA has already been satisfied — and replaying it requires no further proof of possession.
The innovation here is operational, not technical. Token theft via AitM has been documented since at least 2022, but this campaign industrialized it: 200,000+ login attempts, 497 successful replays, and rapid post-access actions to establish durable persistence before victims or automated revocation could intervene.
Persistence Is the Real Damage
The stolen session token expires. The rogue device registration and new authenticator app do not — until someone notices and removes them.
The most damaging phase of this attack occurs after initial access. Huntress observed attackers registering new authenticator applications (in one case, an app named "iPhone 13" within 51 minutes of compromise) and enrolling 48 fake devices into victim directories. These artifacts survive token revocation, password resets, and even some conditional access policy changes. In 19 organizations, existing MFA methods were stripped and replaced within three hours — ensuring the attacker controlled the second factor going forward.
This is the pattern defenders must hunt for: not the stolen token, but the identity infrastructure modifications that follow.
Hidden Inbox Rules: The Quiet Exfiltration Layer
The attackers deployed inbox rules with deliberately innocuous names — ".", "sss", "iT", "........" — to suppress messages containing keywords like "payroll," "deposit," and "bonus." This is a classic business email compromise (BEC) enabler: hiding financial transaction confirmations from the account owner while attackers manipulate wire details or redirect deposits. These rules are trivial to create but routinely missed in incident response because they don't trigger alerts in most default monitoring configurations.
Who Is Most Exposed
Shield53 Recommendations
Immediate Actions:
- Block 193.26.115.0/24 at your perimeter, firewall, and Microsoft 365 trusted IP lists — this range is associated with the documented campaign
- Audit Entra device registrations: Export all registered devices and investigate any added between July 14 and September 22, 2026, particularly devices with generic names or no recent compliance reporting
- Review authentication methods: Query the Microsoft Graph API for all MFA methods registered per user and flag any added outside normal helpdesk workflows
- Hunt for hidden inbox rules: Run a script against all mailboxes to enumerate rules where name matches single-character or repetitive patterns (".", "s", "ss", "iT") or where rules delete or move mail from inbox
Structural Hardening:
- Mandate phishing-resistant MFA: FIDO2 security keys or Windows Hello for Business cannot be relayed by AitM proxies — the authentication ceremony is cryptographically bound to the origin domain
- Enforce conditional access: Require compliant devices or trusted locations for Microsoft 365 access; block legacy authentication entirely; require reauthentication for high-risk sign-ins
- Enable continuous access evaluation (CAE) in Entra ID to reduce token lifetime exposure and enforce near-real-time revocation on policy violations
- Configure alerting on identity events: New device registrations, MFA method additions/removals, impossible travel sign-ins, and suspicious inbox rule creation should trigger SOC review within minutes, not days
Token-replay attacks succeed because organizations treat authentication as a perimeter event rather than a continuous trust evaluation. The infrastructure to stop this exists today in Entra ID — but it requires configuration, monitoring, and the willingness to deprecate MFA methods that phishing has already outmatched.
