M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress, Thursday, October 22nd, 2026
Huntress tracked an M365 token replay campaign that hit 79 organizations with nearly 500 successful sign-ins.
Huntress tracked a Microsoft 365 campaign from July 14 to September 22, 2026 in which attackers captured sessions through adversary-in-the-middle relays and replayed stolen tokens from a German hosting provider's IP block.
It responded to incidents at 79 organizations, seeing at least 497 successful sign-ins and over 200,000 failed attempts.
Attackers registered at least 48 rogue Entra devices, replaced MFA methods and created hidden inbox rules.
Huntress recommends Conditional Access requiring MFA everywhere and full containment beyond password resets, including removing attacker devices and MFA methods.