Threat reportPhishingTL-2026-4143
M365 Token Spray and Replay Campaign Compromises Business Email Accounts (AiTM-harvested tokens replayed from 1337 Services GmbH infrastructure)
M365 Token Spray and Replay Campaign Compromises Business (TL-2026-4143) is a high-severity phishing campaign, first published 2026-10-22. It has no confirmed attribution, affects Microsoft Microsoft 365 / Entra ID (Exchange Online, SharePoint, maps to 9 MITRE ATT&CK techniques (T1078.004, T1090.003, T1098.005), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4143
- Threat ID
- TL-2026-4143
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 16
How M365 Token Spray and Replay Campaign Compromises Business works
Between July 14 and September 22, 2026, Huntress tracked a Microsoft 365 campaign in which adversary-in-the-middle relays captured post-MFA session tokens that were replayed from hosting infrastructure (1337 Services GmbH, AS210558, 193.26.115.0/24). The campaign logged 497 successful sign-ins against more than 200,000 failed attempts across 79 organizations, with 48 rogue Entra-joined devices registered, MFA methods wiped and replaced in 19 organizations, and hidden inbox rules created.
Huntress observed a roughly ten-week Microsoft 365 / Entra ID campaign (July 14 to September 22, 2026) that combined large-scale password/token spraying with replay of post-MFA tokens captured by adversary-in-the-middle (AiTM) phishing relays. Because the tokens were issued after the victim completed MFA, the replayed sessions bypassed MFA. Replay sign-ins originated from hosting infrastructure operated by 1337 Services GmbH (AS210558), principally the 193.26.115.0/24 range, with six addresses in that range carrying the bulk of activity across four phases. In total Huntress logged 497 successful sign-ins against more than 200,000 failed attempts and 200,000+ targeted addresses, affecting 79 organizations.
Replay traffic was visible in Entra sign-in logs as OAuth2:Token, Login:reprocess and Cmsi:Cmsi request types, using first-party client application IDs (Microsoft Office, Microsoft Authentication Broker, OfficeHome) against Microsoft Graph, Exchange Online, SharePoint Online and the Device Registration Service. User agents were distinctive: a bare 'node' string and a bare 'Mozilla/5.0' string (Build A tooling) and current Chrome/Edge on Windows (Build B). AiTM relay addresses seen in the campaign included 185.238.2.195 (Phase 1) and an Evoxt Sdn. Bhd. IPv6 address (Phase 4).
After access, the operator established persistence by registering 48 rogue devices into Entra ID with names matching DESKTOP- followed by exactly eight uppercase hexadecimal characters, and by wiping and replacing MFA methods (19 organizations), including registering an authenticator labelled 'iPhone 13'. Mailbox manipulation used REST APIs to create hidden inbox rules with one- or two-character or punctuation-only names (for example '.', 'sss', 'ss', 'iT', ',.', '........', 's', 'd') that move mail to obscure folders (RSS Feeds, RSS Subscriptions, Conversation History); rules created from 167.148.41.96 (Interserver) targeted payroll and banking keywords. Conditional Access was decisive: in Phase 3, 1,052 sign-ins from 193.26.115.72 were blocked (AADSTS53003) where policies existed, while 232 sign-ins from the same IP succeeded across 28 organizations without such policies. Tunneling through VDI operators and consumer VPNs was also noted.
The source names no threat actor. Huntress notes Microsoft Entra ID Protection detections and that the founder of 1337 Services GmbH was reportedly associated with the Cracked cybercrime forum (Krebs on Security, February 2025); this is hosting-provider context, not attribution of the campaign to a specific actor. Defenders should revoke sessions (password reset alone does not invalidate access tokens with ~90-minute lifetime), remove rogue devices and MFA methods, audit inbox rules, and enforce Conditional Access that requires MFA for all users, apps and client types and restricts device-code flow.
MITRE ATT&CK techniques used in TL-2026-4143
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1566.002 Phishing: Spearphishing Link
Command and Control
T1090.003 Proxy: Multi-hop Proxy
Persistence
T1098.005 Account Manipulation: Device Registration; T1556.006 Modify Authentication Process: Multi-Factor Authentication
Credential Access
T1110.003 Brute Force: Password Spraying; T1557 Adversary-in-the-Middle
lateral-movement
T1550.001 Use Alternate Authentication Material: Application Access Token
Defense Evasion
Affected products and versions in M365 Token Spray and Replay Campaign Compromises Business
- Microsoft — Microsoft 365 / Entra ID (Exchange Online, SharePoint Online, Microsoft Graph, Device Registration Service)
Vulnerable versions: Tenants without unconditional MFA / Conditional Access coverage for all client types
Remediation for M365 Token Spray and Replay Campaign Compromises Business
Immediate actions
- Revoke all user sessions and refresh tokens for affected accounts, then reset passwords (a password reset alone does not invalidate access tokens with ~90-minute lifetime)
- Audit and remove rogue Entra-joined devices matching DESKTOP-[0-9A-F]{8} that were registered from non-organizational IPs
- Audit and remove attacker-registered MFA methods (for example an authenticator labelled 'iPhone 13') and re-enroll legitimate methods
- Review mailboxes for inbox rules with single/double-character or punctuation-only names and rules moving mail to RSS Feeds, RSS Subscriptions or Conversation History; remove rules hiding payroll/banking keywords
- Block 193.26.115.0/24 (AS210558) and hunt for sign-ins from the listed IOC addresses
Workarounds
- Apply Conditional Access policies restricting sign-ins by network location and device compliance
- Require compliant or hybrid-joined devices for access to Device Registration Service
Longer-term hardening
- Enforce Conditional Access requiring MFA unconditionally for all users, applications and client types
- Restrict or block the device-code authentication flow with authentication-flow policies
- Disable standard user application consent and require admin approval for new enterprise applications
- Adopt phishing-resistant authentication and Token Protection where supported to limit token replay
- Alert on OAuth2:Token and Cmsi:Cmsi sign-ins from hosting IPs using Microsoft Office or Authentication Broker client IDs
Timeline of M365 Token Spray and Replay Campaign Compromises Business
- Krebs on Security reports that 1337 Services GmbH (Hamburg) owned RDP services tied to the seized Cracked and Nulled forums; its founder was linked to the Cracked forum.
- Campaign begins; Phase 1 token replay and spraying through 193.26.115.221 and 193.26.115.199, with AiTM relay 185.238.2.195.
- Phase 1 activity from 193.26.115.221/.199 ends.
- Phase 2 begins via 193.26.115.16 and 193.26.115.21, continuing into early September; the .21 address used a bare 'Mozilla/5.0' user agent (Build A).
- Phase 4 begins via 193.26.115.210, with an Evoxt Sdn. Bhd. IPv6 AiTM relay, continuing to September 22.
- Phase 3 burst from 193.26.115.72 (September 11-15): 1,052 sign-ins blocked by Conditional Access in the few organizations with protections, while 232 succeeded across 28 organizations without them.
- Last observed campaign activity; totals of 497 successful sign-ins, 200,000+ failed attempts, 79 organizations, 48 rogue Entra devices.
- Huntress publishes its analysis of the M365 token spray and replay campaign.
Sources cited for M365 Token Spray and Replay Campaign Compromises Business
- M365 Token Spray and Replay Campaign Compromises Business Email Accounts
- Who's Behind the Seized Forums Cracked & Nulled? (Krebs on Security)
- Police seizes Cracked and Nulled hacking forum servers, arrests suspects (BleepingComputer)
- AS210558 1337 Services GmbH (DB-IP)
- 1337 Services GmbH (RIPE NCC membership)
- Breaking down Token Protection in Conditional Access (T-Minus365)
- Tokens in Microsoft Entra ID (concept overview)
Detection coverage for TL-2026-4143
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4143 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.