Token Spraying: How Attackers Bypassed MFA and Compromised 97 Microsoft 365 Accounts Across 79 Organizations
Executive Summary
Between July 14 and September 22, 2026, threat actors executed a large-scale adversary-in-the-middle (AitM) token-replay campaign against Microsoft 365, compromising 97 accounts across 79 organizations from more than 200,000 login attempts. Attackers deployed fake Microsoft sign-in pages to harvest session tokens and MFA codes in real time, then replayed those tokens within minutes from infrastructure tied to Romanian and German hosting provider 1337 Services GmbH. Post-access persistence was achieved by registering 48 rogue Entra devices, hijacking MFA methods, and planting hidden inbox rules to intercept payroll and finance-related emails—enabling business email compromise at scale.
This campaign illustrates the accelerating shift away from password-based attacks toward token-based identity exploitation, where MFA alone provides insufficient protection. As AitM phishing kits become commoditized and token-spraying techniques proliferate, organizations relying solely on perimeter defenses and standard MFA face compounding exposure across cloud identity platforms.
Why This Matters Now
Token-replay and AitM attacks have surged in 2025–2026 as attackers systematically bypass MFA, rendering traditional credential-security investments insufficient. With 79 organizations hit in a single campaign and rogue device registrations persisting until manually removed, security teams face identity sprawl they may not detect for weeks—making Conditional Access hardening and network-level egress controls urgent priorities.
Attack Path Analysis
Attackers deployed adversary-in-the-middle relay infrastructure to harvest Microsoft 365 session tokens and MFA codes from victims at 79 organizations, then replayed stolen tokens at scale ('token spraying') from Romanian-linked IP ranges to authenticate as victims without triggering MFA. Once inside, they escalated persistence by registering rogue Entra devices and adding attacker-controlled authenticator apps, pivoted across mailboxes and tenants, established covert email rules to suppress detection, and ultimately abused compromised accounts for outbound spam and business email compromise-style fraud targeting payroll and financial keywords.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Victims were directed to adversary-in-the-middle (AitM) relay pages mimicking Microsoft 365 login portals, as well as targeted via device-code phishing and social engineering during legitimate login flows. These relays captured valid credentials, MFA codes, and the resulting session access tokens in real time. Over 200,000 login attempts were traced to the 193.26.115.0/24 IP range associated with 1337 Services GmbH / StarkRDP infrastructure running AsyncRAT. CNSF cloud firewall (ACF) egress controls and inline IPS (Suricata) could have flagged outbound connections to known-malicious IPs and blocked phishing relay traffic, while Cloud Native Security Fabric (CNSF) distributed policy enforcement with real-time inspection would have provided the best prevention surface at this stage.
MITRE ATT&CK® Techniques
Adversary-in-the-Middle
Steal Web Session Cookie
Use Alternate Authentication Material: Web Session Cookie
Account Manipulation: Device Registration
Hide Artifacts: Email Hiding Rules
Phishing
Multi-Factor Authentication Request Generation
Valid Accounts: Cloud Accounts
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Authenticator Management and Session Integrity
Control ID: IA-5, IA-11, SC-23
PCI DSS 4.0 – Multi-Factor Authentication and Account Management Controls
Control ID: Requirement 8.2, 8.6
NYDFS 23 NYCRR 500 – Multi-Factor Authentication and Monitoring of Privileged Access
Control ID: 500.12, 500.14
CISA Zero Trust Maturity Model 2.0 – Continuous Identity Validation and Device Trustworthiness
Control ID: Identity Pillar — Advanced/Optimal: Continuous Validation, Device Trust
NIS2 Directive – Access Control Policies and Incident Handling
Control ID: Article 21(2)(a), 21(2)(e)
DORA (Digital Operational Resilience Act) – ICT Security — Authentication Controls and Threat Monitoring
Control ID: Article 9(4)(c), Article 10
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Token-replay attacks targeting Microsoft 365 expose financial firms to credential theft, rogue Entra device registration, and payroll-redirect email rules, undermining NIST.800-53.AC-6 and PCI.4.0.7.2.4 zero trust segmentation controls.
Health Care / Life Sciences
AitM-captured MFA tokens and hidden inbox rules at healthcare organizations risk PHI exfiltration, violating HIPAA.164.312(e)(1) and HIPAA.164.308(a)(3), with lateral movement scoring amplifying breach impact across clinical systems.
Information Technology/IT
IT organizations managing Microsoft 365 tenants across 79 victim orgs face identity compromise via token spraying, AsyncRAT-linked infrastructure, and rogue device persistence, directly challenging ZTMM identity and multicloud visibility controls.
Banking/Mortgage
Stolen session tokens enabling payroll and deposit keyword-filtering inbox rules place banking institutions at acute business email compromise risk, with egress exfiltration scoring and PCI.4.0.3.5.1 policy enforcement gaps highlighted in validated capabilities.
Sources
- Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizationshttps://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.htmlVerified
- Token Replay Spray: Huntress Research on Microsoft 365 AitM Campaignhttps://www.huntress.com/blog/token-replay-sprayVerified
- Microsoft Flags Multi-Stage AitM Phishing Attackshttps://thehackernews.com/2026/01/microsoft-flags-multi-stage-aitm.htmlVerified
- Microsoft Takes Down EvilTokens Device-Code Phishing Infrastructurehttps://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.htmlVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Microsoft Entra ID Protection Documentationhttps://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protectionVerified
- Whos Behind the Seized Forums Cracked Nulled - Krebs on Securityhttps://krebsonsecurity.com/2025/02/whos-behind-the-seized-forums-cracked-nulled/Verified
- GreyNoise Intelligence: 1337 Services GmbH IP Listingshttps://viz.greynoise.io/ips?q=metadata.organization:%221337+Services+GmbH%22Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This incident involved adversary-in-the-middle phishing infrastructure harvesting Microsoft 365 session tokens at scale, enabling token replay across 79 organizations without re-triggering MFA — a pattern where Aviatrix Zero Trust CNSF's egress enforcement, segmentation, and east-west inspection would likely reduce attacker reachability and constrain the blast radius across cloud-hosted workloads and identities. By enforcing identity-aware routing and controlled egress policies, CNSF could limit how far replayed tokens and rogue device registrations translate into sustained cross-tenant access.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Outbound connections toward known-malicious relay infrastructure in the 193.26.115.0/24 range could likely be flagged and restricted through CNSF distributed policy enforcement, reducing the number of victim sessions successfully intercepted by the AitM relay.
Control: Zero Trust Segmentation
Mitigation: Identity-based segmentation policies enforcing least-privilege access could limit the ability of unverified or anomalous device identities to register within tenant directories or modify MFA configurations without posture-verified step-up verification, reducing the persistence foothold attackers could establish.
Control: East-West Traffic Security
Mitigation: East-west inspection of workload-to-workload and service-to-service authentication flows would likely surface anomalous inter-tenant token usage patterns, reducing the scope of cross-tenant lateral movement that attacker-controlled devices could execute before being flagged.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility would likely surface repeated sign-in anomalies and suspicious automation patterns originating from known-bad IP ranges, reducing the dwell time available for C2 infrastructure to operate undetected across victim cloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies with FQDN filtering and outbound traffic inspection would likely constrain unauthorized bulk mail flows and unexpected data transfers to external destinations, reducing the volume of sensitive information reachable by attacker-controlled outbound channels.
Had earlier CNSF controls reduced attacker reachability across egress paths, east-west authentication flows, and tenant boundaries, the residual blast radius reaching financial fraud and persistent MFA compromise would likely have been narrower, with fewer organizations exposed to payroll redirection and long-term account takeover.
Impact at a Glance
Affected Business Functions
- Corporate Email and Messaging (Microsoft 365 Exchange Online)
- Identity and Access Management (Microsoft Entra ID / MFA)
- Payroll and Human Resources Communications
- IT Security Operations and Incident Response
Estimated downtime: 7 days
Estimated loss: N/A
Across 79 organizations and 97 compromised accounts, attackers gained persistent access to corporate Microsoft 365 email inboxes, enabling interception and deletion of sensitive communications referencing payroll, direct deposit, and bonus transactions. Hidden inbox rules were used to suppress or redirect financial correspondence, indicating high likelihood of business email compromise (BEC) fraud attempts. Forty-eight rogue Entra devices were registered, providing durable token issuance capability. At least 19 organizations had existing MFA methods removed and replaced by attacker-controlled authenticator apps, resulting in full account takeover and potential exposure of internal business data, HR records, financial communications, and any documents accessible via the compromised Microsoft 365 tenants. Outbound spam was also sent from at least one compromised mailbox to hundreds of external recipients, creating reputational and compliance risk.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Zero Trust Segmentation with identity-based conditional access policies requiring device posture validation and step-up MFA for all Entra device registrations and MFA method modifications, preventing rogue device enrollment even when valid session tokens are replayed.
- • Implement Multicloud Visibility & Control with centralized traffic observability and anomaly baselining to detect token-spraying patterns — specifically high-volume failed and successful authentication events originating from clustered IP ranges such as 193.26.115.0/24 — and trigger automated session revocation workflows.
- • Enable Egress Security & Policy Enforcement with FQDN filtering and data loss prevention rules to block outbound connections to known AitM relay infrastructure, restrict bulk outbound mail flows from cloud identities, and prevent exfiltration of financial communications to unauthorized destinations.
- • Leverage Cloud Firewall (ACF) and Inline IPS (Suricata) with up-to-date threat signatures to inspect and block traffic to IP ranges and domains associated with AsyncRAT, StarkRDP / 1337 Services GmbH, and device-code phishing relay pages before tokens are harvested.
- • Apply Cloud Native Security Fabric (CNSF) distributed policy enforcement with real-time inspection across all Microsoft 365 authentication flows, enforcing Conditional Access Policies unconditionally for all users, all cloud apps, and all client app types, while restricting device-code authentication workflows to eliminate the token-replay attack surface at its source.
