Huntress has identified a campaign that reused stolen Microsoft 365 sign-in tokens to access 79 organizations, recording 497 sign-in events and more than 200,000 failed attempts over 10 weeks. The activity ran from July 14 through September 22, with attackers seeking persistent access through rogue devices, replacement authenticators and hidden mailbox rules.
The researchers call the technique “token spraying” because it replays stolen authentication tokens at scale rather than guessing passwords. Tokens came from adversary-in-the-middle relays, device-code phishing and social engineering during legitimate login processes.
In a relay attack, the victim sees Microsoft’s real login and multifactor-authentication prompts, while the intermediary captures the session token issued after authentication. An attacker holding that token can reuse the authenticated session without completing the MFA challenge again.
Huntress traced the main replay infrastructure to six addresses in a rented IP block associated with Germany’s 1337 Services GmbH, which it describes as a legitimate hosting provider. The relays capturing sessions and the servers replaying them operated on separate infrastructure. In one July 21 incident, the gap between the victim reaching the MFA prompt and the hijacked session appearing was 12 minutes.
The attacker registered at least 48 fake computers in victims’ Microsoft directories. Those devices used “DESKTOP-” followed by eight uppercase hexadecimal characters, differing from Windows’ default of seven alphanumeric characters. In 19 organizations, existing MFA methods were erased and a new method registered within three hours of the first campaign-linked sign-in. Those changes could preserve access beyond the life of the initially stolen session.
Hidden inbox rules marked messages as read, deleted them or moved them into folders such as RSS Feeds and Conversation History. In one case, an attacker sent a payroll-related email to an external accountant and created rules to conceal responses.
Huntress recommends revoking sessions and resetting the password, then auditing registered devices, MFA methods and inbox rules. A password reset alone does not remove attacker-added devices or authenticators, and an access token can remain valid until it expires unless sessions are revoked or disabled. The researchers also recommend restricting device-code authentication flows through Conditional Access policies and reviewing suspicious token exchanges from hosted infrastructure.
Sources: Huntress
–
By the ID Tech Editorial Team
