Huntress investigation published October 22, 2026; campaign ran July 14 to September 22, 2026
Token Spraying: Stolen Microsoft 365 Sessions Compromised 97 Accounts at 79 Organizations
Huntress reported a ten-week Microsoft 365 campaign it calls token spraying, in which attackers replayed sign-in tokens stolen after victims completed multifactor authentication, instead of guessing passwords. Between July 14 and September 22, 2026, Huntress counted 497 successful sign-in events across 79 victim organizations against more than 200,000 failed attempts, all traced to the 193.26.115.0/24 block at German hosting provider 1337 Services GmbH; 97 accounts were compromised and at least 48 rogue Entra devices were registered. Tokens came from adversary-in-the-middle relays behind fake sign-in pages, device-code phishing, and social engineering during legitimate sign-ins, and were replayed within minutes: 12 minutes in a July 21 case, four minutes on September 22. For persistence the attackers registered their own authenticator apps, in 19 organizations wiping the victim's existing MFA methods within three hours, and planted hidden inbox rules that moved or deleted messages mentioning payroll, direct deposit, bank, or bonus; in one case a compromised mailbox sent a payroll-related email to an outside accountant. Conditional Access did real work where it existed: one September burst logged 1,052 blocked sign-ins, but every block came from just four organizations.
Executives
Multifactor authentication was completed in these breaches, and it did not save the accounts, because the attackers stole what the completed sign-in produced. The follow-up question for any Microsoft 365 estate is narrow and testable: if a session is stolen today, what stops it from being replayed from a rented server on another continent, and how would you know within the hour.
CIO / CISO
A password reset alone does not end this compromise. Huntress's cleanup list is the standard to adopt: revoke sessions and reset the password together, remove rogue Entra devices, audit and remove attacker-registered MFA methods, delete hidden inbox rules, and review app consents. Then close the door with Conditional Access covering all users, all cloud apps, and all client types, and restrict the device-code flow, which this campaign used as a token source.
Engineers
Hunt Entra sign-in logs for the campaign pattern: OAuth2 token requests and sign-ins from hosting provider address ranges, devices named DESKTOP- followed by eight hex characters, MFA method changes within hours of an unusual sign-in, and inbox rules with forgettable names that move mail to RSS Feeds or Conversation History. Block the full 193.26.115.0/24 range rather than single addresses, because the operator rotated through six addresses in it.
Everyone (non-IT)
A sign-in page that looks exactly like Microsoft and asks for your code can hand your finished session to an attacker. Reach Microsoft 365 through your own bookmark or your work portal, never through a link in an unexpected email, and report any sign-in prompt you did not start to your IT team at once.