Overview
Huntress has disclosed a Microsoft 365 campaign, observed between July 14 and September 22, 2026, that uses an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replays the stolen tokens. It compromised 97 accounts at 79 organizations.
How It Works
A fake login page sits between the victim and Microsoft's real sign-in, relaying credentials and MFA codes. Because the attacker receives the resulting access token, MFA does not need to be bypassed again. Tokens are replayed from attacker-controlled devices within minutes in automated sign-ins that Huntress calls token spraying. Tokens also came from device-code phishing and social engineering.
Scale: 497 successful sign-ins out of more than 200,000 attempts.
Post-Compromise Behavior
- Attackers registered their own authenticator apps to survive session revocation.
- In at least 19 organizations, existing MFA methods were removed and replaced within three hours of first sign-in.
- One authenticator named "iPhone 13" was activated less than 51 minutes after a session hijack.
- At least 48 rogue devices were registered in victims' Entra directories.
- Hidden inbox rules (names such as
.,,sss,d) deleted or hid mail mentioning payroll, deposit, or bonus. One compromised mailbox sent spam to hundreds of external recipients.
Indicators
- Source IP range
193.26.115.0/24; first observed193.26.115.221(Romania) - Hosting provider 1337 Services GmbH; linked to StarkRDP / rdp.sh services
Recommendations
- Revoke sessions and reset passwords for suspected victims.
- Audit Entra-registered devices and delete unrecognized ones.
- Review MFA methods for unauthorized additions or removals.
- Check for unexpected inbox rules and new enterprise applications.
- Restrict the device-code flow with Conditional Access, and prefer phishing-resistant MFA and token-binding controls.