# M365 Token Spray and Replay Campaign Compromises Business Email Accounts (AiTM-harvested tokens replayed from 1337 Services GmbH infrastructure)

> Between July 14 and September 22, 2026, Huntress tracked a Microsoft 365 campaign in which adversary-in-the-middle relays captured post-MFA session tokens that were replayed from hosting infrastructure (1337 Services GmbH, AS210558, 193.26.115.0/24). The campaign logged 497 successful sign-ins against more than 200,000 failed attempts across 79 organizations, with 48 rogue Entra-joined devices registered, MFA methods wiped and replaced in 19 organizations, and hidden inbox rules created.

- **Published:** 2026-10-22T13:12:26Z
- **Last reviewed:** 2026-10-22T13:12:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4143
- **ID:** TL-2026-4143
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Huntress observed a roughly ten-week Microsoft 365 / Entra ID campaign (July 14 to September 22, 2026) that combined large-scale password/token spraying with replay of post-MFA tokens captured by adversary-in-the-middle (AiTM) phishing relays. Because the tokens were issued after the victim completed MFA, the replayed sessions bypassed MFA. Replay sign-ins originated from hosting infrastructure operated by 1337 Services GmbH (AS210558), principally the 193.26.115.0/24 range, with six addresses in that range carrying the bulk of activity across four phases. In total Huntress logged 497 successful sign-ins against more than 200,000 failed attempts and 200,000+ targeted addresses, affecting 79 organizations.

Replay traffic was visible in Entra sign-in logs as OAuth2:Token, Login:reprocess and Cmsi:Cmsi request types, using first-party client application IDs (Microsoft Office, Microsoft Authentication Broker, OfficeHome) against Microsoft Graph, Exchange Online, SharePoint Online and the Device Registration Service. User agents were distinctive: a bare 'node' string and a bare 'Mozilla/5.0' string (Build A tooling) and current Chrome/Edge on Windows (Build B). AiTM relay addresses seen in the campaign included 185.238.2.195 (Phase 1) and an Evoxt Sdn. Bhd. IPv6 address (Phase 4).

After access, the operator established persistence by registering 48 rogue devices into Entra ID with names matching DESKTOP- followed by exactly eight uppercase hexadecimal characters, and by wiping and replacing MFA methods (19 organizations), including registering an authenticator labelled 'iPhone 13'. Mailbox manipulation used REST APIs to create hidden inbox rules with one- or two-character or punctuation-only names (for example '.', 'sss', 'ss', 'iT', ',.', '........', 's', 'd') that move mail to obscure folders (RSS Feeds, RSS Subscriptions, Conversation History); rules created from 167.148.41.96 (Interserver) targeted payroll and banking keywords. Conditional Access was decisive: in Phase 3, 1,052 sign-ins from 193.26.115.72 were blocked (AADSTS53003) where policies existed, while 232 sign-ins from the same IP succeeded across 28 organizations without such policies. Tunneling through VDI operators and consumer VPNs was also noted.

The source names no threat actor. Huntress notes Microsoft Entra ID Protection detections and that the founder of 1337 Services GmbH was reportedly associated with the Cracked cybercrime forum (Krebs on Security, February 2025); this is hosting-provider context, not attribution of the campaign to a specific actor. Defenders should revoke sessions (password reset alone does not invalidate access tokens with ~90-minute lifetime), remove rogue devices and MFA methods, audit inbox rules, and enforce Conditional Access that requires MFA for all users, apps and client types and restricts device-code flow.

## MITRE ATT&CK

- T1566.002 Phishing: Spearphishing Link
- T1078.004 Valid Accounts: Cloud Accounts
- T1557 Adversary-in-the-Middle
- T1110.003 Brute Force: Password Spraying
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1564.008 Hide Artifacts: Email Hiding Rules
- T1098.005 Account Manipulation: Device Registration
- T1556.006 Modify Authentication Process: Multi-Factor Authentication
- T1090.003 Proxy: Multi-hop Proxy

## Sources

- [M365 Token Spray and Replay Campaign Compromises Business Email Accounts](https://www.huntress.com/blog/token-replay-spray)
- [Who's Behind the Seized Forums Cracked & Nulled? (Krebs on Security)](https://krebsonsecurity.com/2025/02/whos-behind-the-seized-forums-cracked-nulled/)
- [Police seizes Cracked and Nulled hacking forum servers, arrests suspects (BleepingComputer)](https://bleepingcomputer.com/news/security/police-seizes-cracked-and-nulled-hacking-forum-servers-arrests-suspects)
- [AS210558 1337 Services GmbH (DB-IP)](https://db-ip.com/as210558-1337-services-gmbh)
- [1337 Services GmbH (RIPE NCC membership)](https://ripe.net/membership/indices/data/de.1337services.html)
- [Breaking down Token Protection in Conditional Access (T-Minus365)](https://tminus365.com/breaking-down-token-protection-in-conditional-access/)
- [Tokens in Microsoft Entra ID (concept overview)](https://docs.azure.cn/en-us/entra/identity/devices/concept-tokens-microsoft-entra-id)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4143