Stolen Microsoft 365 Sessions Replayed Against 79 Organisations in Ten-Week Email Compromise Campaign

Between July 14, 2026 and September 22, 2026, Huntress tracked a Microsoft 365 campaign that captured sign-in sessions using adversary-in-the-middle (AiTM) relays. The attacker then replayed the stolen tokens from an IP address block owned by German hosting provider 1337 Services GmbH. Rather than guessing passwords, they reused sessions already approved by victims. Huntress responded to related incidents at 79 organisations, saw at least 497 successful sign-in events, and traced more than 200,000 failed login attempts to the same IP range.

Once inside an account, the attacker set the stage for business email compromise. Huntress observed at least 48 rogue Entra devices being registered, victims' multi-factor authentication (MFA) methods being wiped and replaced, and inbox rules being created to hide malicious messages. In one incident, the compromised account was used to send a payroll-related email to an outside contact. Attackers often use hosting providers like this one to run malicious traffic, a tactic known as "bring your own IP".

Huntress says properly implemented Conditional Access Policies can prevent token replay attacks. To contain an incident, revoke the user's sessions and reset the password, then remove any attacker-registered devices and MFA methods, because a password reset alone leaves these in place.