Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
- ID
- 39475
- Status
- summarized
- Published
- 26 Oct 2026, 4:35 PM
- Fetched
- 26 Oct 2026, 6:29 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 26 Oct 2026, 6:30 PM
- Tags
- Audience
- developerssaas_startup_founders
What happened
Huntress tracked a Microsoft 365 campaign from July 14 to September 22, 2026, in which an adversary-in-the-middle login page relayed credentials and MFA codes to real Microsoft infrastructure, then replayed the issued access token from attacker devices within minutes. Over 200,000 login attempts from the 193.26.115[.]0/24 range produced 497 successful sign-ins across 79 organizations, 97 compromised accounts, and 48 rogue Entra device registrations. Huntress calls the pattern 'token spraying' because the attacker never needs to crack a password or bypass MFA twice.
Why it matters
If your product or company runs on Microsoft 365, the failure mode here isn't a weak password — it's that a valid token plus a registered Entra device is enough to look legitimate, so a successful phish survives a password reset. Concrete action: check your tenant's device registration list for entries nobody in IT created (48 appeared across 79 orgs here) and block or alert on sign-ins from hosting/VPS IP ranges, since the whole campaign came from a single /24.
Discussion angle
Token replay defeats the 'we have MFA, so we're fine' assumption — what would your team actually check first if an attacker already held a valid session token, and does anyone review Entra device registrations today?