Breaches and incidentsBriefChecked against a primary source
Microsoft 365 “token spraying” campaign: 79 organizations
Huntress: between 14 Jul and 22 Sep 2026 an actor captured tokens via adversary-in-the-middle phishing (plus device-code phishing) and replayed them.
- Disclosed
What happened
- Huntress: between 14 Jul and 22 Sep 2026 an actor captured tokens via adversary-in-the-middle phishing (plus device-code phishing) and replayed them; at least 497 successful sign-ins against 200,000+ failed attempts across 79 organizations, with at least 48 rogue Entra devices registered. THN reports 97 compromised accounts; Huntress’s post does not state an account count. Huntress’s own Phase 3 sub-figures are internally inconsistent.
- Techniques: T1557 AitM, token replay (T1550.001), rogue device registration, MFA method replacement within three hours at 19+ orgs, hidden inbox rules for payroll/deposit mail.
- Attribution: none. Infrastructure links to 1337 Services GmbH hosting.
Sources
- https://www.huntress.com/blog/token-replay-spray
- https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.