Microsoft 365 Token Replay Attacks Let Hackers Access Business Emails Without Passwords

Hackers accessed Microsoft 365 environments at 79 organizations by replaying stolen sign-in sessions, letting them enter business accounts without victims’ passwords.

Huntress recorded 497 successful sign-ins and more than 200,000 failed attempts during the ten-week campaign, which ran from July 14 through September 22, 2026.

Use of the provider’s network does not establish its involvement in the attacks.

The attackers used adversary-in-the-middle, or AiTM, phishing to intercept legitimate Microsoft authentication flows.

Victims interacted with relayed sign-in pages and completed multifactor authentication, after which the relay captured the authenticated session.

Huntress explains that this technique lets attackers impersonate authenticated users without deploying malware.

Replaying that session allowed the operator to access Microsoft services without entering the password or completing a fresh MFA challenge.

The investigation also identified device-code phishing and social engineering during legitimate authentication.

These paths differ from conventional AiTM interception but similarly leave attackers holding tokens authorizing access.

On July 21, a victim reached an MFA prompt through relay address 185.238.2[.]195 at 17:18 UTC.

Twelve minutes later, the hijacked session appeared from 193.26.115[.]199. By 18:08, an authenticator labeled “iPhone 13” had been registered.

Huntress identified two replay toolsets. One used scripted OAuth2:Token requests, frequently with a node user agent, targeting Microsoft Graph, Exchange Online, SharePoint Online, and Device Registration Service.

The other replayed browser sessions through Chrome or Edge against OfficeHome and Exchange Online.

Huntress described the campaign, as token spraying: automated attempts to reuse stolen authentication artifacts across multiple organizations rather than guessing passwords.

Across affected environments, attackers registered at least 48 rogue Entra devices. Their names followed a distinctive pattern: DESKTOP- followed by eight uppercase hexadecimal characters.

Microsoft 365 Token Replay Attacks

Investigators also observed existing MFA methods being removed and replaced within three hours of initial campaign-linked access at 19 organizations.

The operation primarily used 193.26.115[.]0/24, an address block associated with German hosting provider 1337 Services GmbH, also identified as AS210558 the infrastructure supported session replay, while separate phishing relays captured authenticated sessions.

These changes extended the compromise beyond the original stolen session. Resetting a password does not remove attacker-controlled authenticators or delete rogue directory devices.

Mailbox manipulation supported business email compromise. Attackers created rules that marked messages as read, deleted them, or moved them into folders such as RSS Feeds and Conversation History.

In one incident, a compromised account sent a payroll-related message to an external accountant while rules concealed payroll discussions and subsequent replies.

Notably, malicious inbox rules originated from other hosting or VPN networks access, not the principal replay range. Blocking that range alone would therefore leave parts of the operation unaddressed.

Defenders should revoke compromised sessions, reset passwords, inspect registered devices and MFA methods, and remove unauthorized inbox rules.

Investigations should correlate successful hosting-origin sign-ins with authentication changes, device registration, and mailbox activity rather than prioritize failed-login volume alone.

Conditional Access policies must cover relevant users, applications, client types, and authentication flows.

Huntress’s earlier LSHIY investigation similarly documented compromises where policy exclusions or incomplete enforcement left authentication paths exposed.

Organizations should restrict unnecessary device-code authentication and investigate unusual token requests involving user mailboxes.

Recovery must address both stolen sessions and persistence mechanisms; otherwise, attackers may retain routes back into the environment after initial containment actions finish.

IOCs

Item	Description
193.26.115[.]221	Build A token replay and rogue device join host (Phase 1, July 14 to August 3).
193.26.115[.]199	Build B session replay host (Phase 1).
193.26.115[.]16	Build A token replay host; device-code phishing (Phase 2).
193.26.115[.]21	Build A token replay host, bare Mozilla/5.0 user agent (Phase 2).

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.