Cybersecurity experts have identified a significant threat to Microsoft 365 users, where attackers employ an adversary-in-the-middle (AitM) relay technique. This method captures and replays authentication tokens to infiltrate email accounts across 79 different organizations.
Attack Mechanics and Impact
Research conducted by Huntress revealed that between July 14 and September 22, 2026, there were 497 successful unauthorized sign-in attempts out of over 200,000. This resulted in 97 accounts being compromised, alongside the registration of 48 fraudulent Entra devices. The attackers bypassed traditional password guessing by replaying stolen tokens from a specific IP range, engaging in what is termed token spraying.
The attack involves an AitM login page that intercepts user credentials and multi-factor authentication (MFA) codes. This data is then relayed to the legitimate Microsoft login page, allowing attackers to obtain access tokens without needing to bypass MFA again.
Methods and Persistence Tactics
Once inside the systems, the attackers quickly moved to establish persistence by adding their own authenticator apps. This enabled them to handle MFA challenges for future sign-ins, especially if the initial session tokens expired or were revoked. In many cases, they disabled existing MFA methods and registered new ones within hours of the initial breach.
The attackers also registered at least 48 fake devices within the victims’ Microsoft directories, ensuring a durable method for token requests. Additionally, hidden email rules were created to manage and manipulate incoming mail, often targeting messages related to financial transactions.
Origins and Prevention Measures
The campaign was first detected originating from a Romanian IP address linked to a remote access trojan. The IP is associated with a German hosting provider, which provides virtual server rentals through platforms like StarkRDP. Despite law enforcement actions against these platforms, they continue to operate under new branding.
Organizations are advised to take proactive measures if they suspect a token-replay attack. Recommendations include revoking sessions, resetting passwords, auditing registered devices, reviewing MFA configurations, and implementing Conditional Access Policies to enhance security.
According to Huntress, Conditional Access Policies can address security gaps left by MFA. These policies should be configured to require MFA for all users and applications, ensuring comprehensive protection.
