Huntress has disclosed a Microsoft 365 campaign that used an adversary-in-the-middle relay to capture sign-in sessions and then replay the stolen tokens to reach corporate email. Across activity observed between 14 July and 22 September 2026, the firm detected 497 successful Microsoft 365 sign-ins at 79 organisations from more than 200,000 login attempts, with 97 accounts ultimately compromised and 48 rogue Entra devices registered. The attackers did not guess passwords: an AitM login page sat between the victim and the real Microsoft sign-in flow, capturing credentials and MFA codes, and the resulting access token — proof of a completed login — was replayed from the attacker's own infrastructure within minutes. Huntress calls this token spraying, because tokens are replayed at scale across organisations in the way passwords are in a traditional spray. Persistence came from adding the attacker's own authenticator app: in at least 19 organisations the victim's existing MFA methods were removed and a new method registered within three hours of the first sign-in, and in one case a new authenticator named "iPhone 13" was activated less than 51 minutes after the hijacked session. More than 200,000 failed attempts were traced to the 193.26.115[.]0/24 range.

• Source article