Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle ( AitM ) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle ( AitM ) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
The attack has been found to employ an AitM login page, which sits between the victims and legitimate Microsoft infrastructure to capture the entered credentials and MFA codes and relay the information to the real login page.
Upon gaining successful access, the attackers moved to add their own authenticator app as a form of persistence to complete MFA challenges for new sign-ins and overcome scenarios where the stolen session token expires or gets revoked by the victim.
The campaign was first observed from a Romanian IP address " 193.26.115[.]221 ," which, according to VirusTotal, is used by a remote access trojan called AsyncRAT.
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
The "proof of login" token is afterward replayed by the attacker from their own devices within minutes to conduct automated sign-in attempts against Microsoft 365 services.
The end goal is to collect the access token issued by Microsoft following the sign-in process so that it doesn't have to bypass MFA a second time.
The approach has been codenamed token spraying, as it involves the attacker replaying many stolen tokens at scale across several organizations in a manner that's analogous to password spraying.
A registered device can give the attacker a more durable way to request tokens than the stolen session alone, and it stays in the directory until someone deletes it." Furthermore, the attackers have also been spotted setting up hidden email rules in victims' inboxes with names such as ".," "sss," "ss," "iT," ",.," "........," "s," and "d" to delete incoming mail with certain keywords referencing payroll, deposit, and bonus, or move them to obscure folders like RSS Feeds and Conversation History.
Therefore, we will restart operation soon, under a different name, to close the chapter [of] 'StarkRDP.'" Organizations who suspect a token replay compromise are recommended to revoke sessions and reset the password, audit Entra devices, review MFA methods, check for unexpected inbox rules or new enterprise applications, and restrict device-code workflow with Conditional Access policies.
What happened
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle ( AitM ) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
The attack has been found to employ an AitM login page, which sits between the victims and legitimate Microsoft infrastructure to capture the entered credentials and MFA codes and relay the information to the real login page.
What changed
Upon gaining successful access, the attackers moved to add their own authenticator app as a form of persistence to complete MFA challenges for new sign-ins and overcome scenarios where the stolen session token expires or gets revoked by the victim.
The campaign was first observed from a Romanian IP address " 193.26.115[.]221 ," which, according to VirusTotal, is used by a remote access trojan called AsyncRAT.
Who is affected
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
The "proof of login" token is afterward replayed by the attacker from their own devices within minutes to conduct automated sign-in attempts against Microsoft 365 services.
Why it matters
The end goal is to collect the access token issued by Microsoft following the sign-in process so that it doesn't have to bypass MFA a second time.
The approach has been codenamed token spraying, as it involves the attacker replaying many stolen tokens at scale across several organizations in a manner that's analogous to password spraying.
Technical details
A registered device can give the attacker a more durable way to request tokens than the stolen session alone, and it stays in the directory until someone deletes it." Furthermore, the attackers have also been spotted setting up hidden email rules in victims' inboxes with names such as ".," "sss," "ss," "iT," ",.," "........," "s," and "d" to delete incoming mail with certain keywords referencing payroll, deposit, and bonus, or move them to obscure folders like RSS Feeds and Conversation History.
Therefore, we will restart operation soon, under a different name, to close the chapter [of] 'StarkRDP.'" Organizations who suspect a token replay compromise are recommended to revoke sessions and reset the password, audit Entra devices, review MFA methods, check for unexpected inbox rules or new enterprise applications, and restrict device-code workflow with Conditional Access policies.
Huntress said the tokens originate from multiple sources, including AitM relays behind fake sign-in pages, device-code phishing , and social engineering during a legitimate login process.
Attribution
The Hacker News: Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle ( AitM ) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.