Microsoft 365 token‑spraying attacks compromise 79 firms

In a 10‑week campaign from mid‑July to late September 2026, attackers used stolen Microsoft 365 sign‑in tokens to breach 79 organisations, logging in 497 times and attempting more than 200,000 times to enter accounts without ever stealing passwords.

How attackers used stolen tokens

After a victim completed a legitimate sign‑in and multi‑factor authentication, the attacker captured the session token that Microsoft issues. The token was then replayed from servers operated by the German hosting provider 1337 Services GmbH, using IP addresses in the 193.26.115.0/24 range. The attacker moved between six addresses in four phases, with brief pauses, in a technique called token‑spraying that lets them bypass MFA and gain access on a scale similar to password‑spraying.

Once inside, the attackers added rogue devices to the victim’s Microsoft Entra directory, wiped existing MFA methods and registered their own phone to the account. They also set hidden inbox rules—named “.”, “sss” and “iT”—that moved or marked mail as read, and used compromised mailboxes to send payroll‑related phishing emails. In 19 organisations the attacker’s own authenticator app was activated within three hours of the first sign‑in, allowing them to complete future MFA steps and survive a password reset.

To defend against such attacks, Huntress recommends revoking all active sessions, resetting passwords, auditing Entra devices and MFA methods, and reviewing inbox rules for changes. Conditional Access Policies that require MFA or block access for all users and all cloud apps can fill gaps that MFA alone cannot, especially when implemented unconditionally.