An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress.
The researchers tracked the campaign between July 14 and September 22, 2026, counting 497 successful sign-ins and more than 200,000 failed login attempts.
The stolen sessions were replayed from servers at 1337 Services GmbH, a hosting provider incorporated in Hamburg, Germany, and Microsoft Entra ID Protection independently flagged several of those addresses.
No password required
“The Microsoft accounts were compromised without the attacker ever needing a password,” researchers noted.
Victims landed on fake sign-in pages backed by adversary-in-the-middle (AiTM) relays, which passed the genuine Microsoft login page and MFA prompt through to them while keeping the session token Microsoft issues once sign-in is complete. Because that token is created after the MFA step, whoever holds it can use it without passing MFA again.
Other tokens were obtained through device-code phishing, in which victims were tricked into entering a code on Microsoft’s legitimate sign-in page, and through social engineering during an ordinary login.
The attacker then replayed the stolen tokens in bulk, mostly from one block of IP addresses. “Because the attacker replayed many stolen tokens at volume across many organizations, we refer to this as ‘token spraying’: the same pattern as password spraying, but with stolen tokens instead of guessed passwords,” the researchers explained.
The stolen sessions were put to use within minutes. In a July 21 incident, the hijacked session appeared from a 1337 Services address 12 minutes after the victim reached the MFA prompt, and on September 22 the gap was four minutes.
Over the course of the campaign, the attacker moved between six addresses in the 193.26.115.0/24 range in four phases, with breaks of a week or two between some of them. The researchers said blocking any one of those addresses would have stopped a single phase at most.
Fake devices and swapped MFA
Once inside an account, the attacker worked to keep access after the stolen session expired. Huntress found at least 48 rogue computers registered in victims’ Microsoft Entra directories, each named “DESKTOP-” followed by eight hexadecimal characters, and a registered device stays in the directory until someone deletes it.
In 19 organizations, the victim’s existing MFA methods were wiped and a new one registered within three hours of the first sign-in from a campaign address.
In the July 21 case, an authenticator app labeled “iPhone 13” was activated on the account less than an hour after the session was hijacked. An authenticator registered this way lets the attacker complete MFA for new sign-ins at will, and that access survives a password reset unless someone audits the account and removes it.
Mail hidden from its owners
Inbox rules with names such as “.”, “sss” and “iT” deleted incoming mail or marked it as read and moved it to folders like RSS Feeds and Conversation History.
In one case, the attacker used a compromised mailbox to send a payroll-related email to an external accountant. In that mailbox, the attacker modified a rule to catch any message mentioning payroll, direct deposit, bank or bonus, and five minutes later created a second rule that hid all mail from the accountant.
On September 11, the attacker switched to a new address and ran an automated program that reused captured tokens. Over four days, it completed hundreds of successful sign-ins at nearly 30 organizations.
The same address was blocked 1,052 times, and every block came from four organizations whose Conditional Access policies refused the sign-ins. These policies can require MFA or block access outright, and Huntress says they can fill some of the security gaps MFA can’t.
To help Microsoft 365 administrators spot and contain similar intrusions, Huntress has also published mitigation guidance and indicators of compromise in its blog post.
