Token replay campaign breaches Microsoft 365 accounts at 79 organisations

Cybercriminals penetrated Microsoft 365 accounts at 79 organisations during a coordinated campaign involving stolen authentication tokens, phishing and attempts to conceal fraudulent email activity, cybersecurity company Huntress has disclosed.

The investigation, published on October 22, identified at least 497 successful sign-ins and more than 200,000 failed login attempts between July 14 and September 22. Researchers said attackers reused legitimate sessions captured through deceptive authentication processes, enabling access even where victims had completed multifactor authentication.

Huntress linked the activity to infrastructure associated with 1337 Services GmbH, a legitimate hosting provider incorporated in Hamburg. The identification concerns servers used for the attacks and does not establish that the hosting company participated in the operation. The individuals directing the campaign have not been identified.

The operation combined adversary-in-the-middle phishing, which intercepts authentication exchanges, with token replay. Rather than guessing passwords, attackers presented captured session credentials to Microsoft services, allowing them to impersonate authorised users while avoiding some conventional login defences.

Investigators observed at least 48 unauthorised devices registered within Microsoft Entra environments. Attackers also removed existing multifactor authentication methods, installed replacements and configured mailbox rules designed to conceal messages from legitimate account holders.

These measures created opportunities for business email compromise, a form of fraud in which criminals exploit trusted accounts to manipulate correspondence, obtain confidential information or redirect payments. Huntress documented one case involving a payroll-related message sent from a compromised mailbox to an external accounting contact.

The attacker established rules identifying messages containing terms associated with payroll, bank accounts, bonuses and direct deposits. Another rule marked communications from the accounting contact as read and moved them into a folder unlikely to attract the account owner’s attention.

Huntress traced much of the malicious traffic to six addresses within a single internet protocol range. The operators switched between addresses during four phases, complicating defensive measures focused on individual sources rather than the wider network.

A concentrated burst began on September 11. Over four days, researchers recorded 303 successful sign-ins across 29 organisations. During one two-hour period, Huntress issued incident reports to 22 customers after detecting automated attempts to reuse authentication tokens.

Security controls blocked 1,052 sign-in attempts from one attacking address, but those blocks occurred across only four organisations. The contrast highlighted the different outcomes produced by security policies configured across customer environments, according to the investigation.

The July activity provided an early indication of the method. On July 21, investigators tracked a phishing relay capturing a victim at a multifactor authentication prompt, followed by unauthorised session use approximately 12 minutes later. A new authenticator application was activated on the account within the hour, illustrating how rapidly a stolen session could lead to changes in account security settings.

During the August and September activity, investigators also identified attempts to access SharePoint Online and Microsoft Graph, the interface used by applications to retrieve information from Microsoft cloud services. These requests widened the potential exposure beyond individual email messages, although the researchers did not quantify any resulting data losses.

The campaign also incorporated device-code phishing, which persuades users to enter an attacker-supplied code on a legitimate Microsoft authentication page. Completing that process can authorise an unauthorised session without requiring the attacker to collect the victim’s password directly.

Researchers identified cases in which compromised accounts were used to register devices and modify authentication settings, potentially maintaining access beyond the initial intrusion. Such changes mean resetting an account password alone may not fully remove an intruder.

Huntress recommended revoking active sessions, resetting passwords and removing unfamiliar devices and authentication methods. It also emphasised conditional access policies, which can restrict token reuse according to device, location and other sign-in conditions.

Microsoft has separately documented phishing operations exploiting authentication tokens and device-code workflows. Its September investigation into the EvilTokens phishing service described widespread mailbox compromises, although that activity has not been established as the same operation identified by Huntress.

The Huntress findings also distinguish successful sign-in events from unique compromised users. Multiple events can involve the same account, while the 79 organisations represent environments where investigators responded to related incidents rather than a confirmed global total.

The final takeover documented in the investigation occurred on September 22, when a captured session was replayed minutes after the victim completed authentication. The attacker subsequently accessed the victim’s email through infrastructure distinct from the phishing relay.