- Attackers stole 497 Microsoft 365 sign-in tokens across 79 organizations using adversary-in-the-middle relays, compromising 97 accounts.
- The threat actors replayed stolen tokens instead of guessing passwords, registering 48 rogue Entra devices to maintain persistence.
- Hidden email rules were deployed to delete messages with payroll or bonus keywords, and one mailbox was used for outbound spam.
- The campaign originated from a Romanian IP associated with remote access trojan AsyncRAT and German hosting provider 1337 Services GmbH.
Cybersecurity researchers at Huntress have disclosed a Microsoft 365 campaign that used an adversary-in-the-middle relay to steal sign-in tokens and replay them into email accounts across 79 organizations. The activity, observed between July 14 and September 22, 2026, involved 497 successful sign-in events out of over 200,000 login attempts.
The attackers ultimately compromised 97 accounts and registered 48 rogue Entra devices. Rather than guessing passwords, they replayed stolen tokens from victims, with all failed login attempts traced to the IP range 193.26.115.0/24.
The attack employed an AitM login page that intercepted credentials and MFA codes, relaying them to Microsoft’s real login page to capture the access token. This token was then replayed from the attackers’ devices within minutes, a technique the researchers call token spraying.
Upon gaining access, the threat actors added their own authenticator app as persistence to handle new MFA challenges. In at least 19 organizations, the victim’s existing MFA methods were removed within three hours of the first sign-in.
In one case on July 21, 2026, a new authenticator app named “iPhone 13” was activated less than 51 minutes after session hijacking. Researchers noted that rogue registered devices give attackers a more durable way to request tokens than a stolen session alone.
The attackers also set up hidden email rules with names like “sss” and “……..” to delete incoming mail referencing payroll, deposit, and bonus, or to move it to obscure folders. In one compromised mailbox, all incoming messages were marked as read and deleted, then the account sent outbound spam to hundreds of recipients before Microsoft Entra ID Protection rated it high risk.
Huntress said the tokens came from multiple sources, including AitM relays, device-code phishing, and social engineering. The campaign was first observed from Romanian IP 193.26.115.221, which VirusTotal links to the remote access trojan AsyncRAT.
That IP is associated with German hosting provider 1337 Services GmbH, which GreyNoise data shows has 29 IP addresses, ten flagged as malicious and five suspicious. The entity is linked to StarkRDP and rdp.sh, which allow paying customers to rent virtual servers via Hack Forums.
Domains for StarkRDP and rdp.sh were taken down in January 2025 as part of an international law enforcement operation called Talent, but both platforms are now operational—StarkRDP rebranded as exy.sh. The StarkRDP Telegram account stated, “StarkRDP has always been operating by the law and is not involved in any of these alleged crimes.” The message added that the seizure was unclear, so the company will restart under a different name.
Organizations suspecting token replay compromise are advised to revoke sessions, reset passwords, audit Entra devices, review MFA methods, and check for unexpected inbox rules or new enterprise applications. Huntress recommends implementing Conditional Access Policies that require MFA for all users, all cloud apps, and all client app types unconditionally.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
