# Huntress tracks stolen-session replay into 79 Microsoft 365 organizations without a password

Source: https://startwithidentity.com/blog/2026-10-22-huntress-tracks-stolen-session-replay-into-79-microsoft-365-organizations/
Last updated: 2026-10-22
License: content by Start with Identity. Cite the source URL.

---

Huntress said on October 22 that it had responded to one campaign at 79 organizations between July 14 and September 22, with at least 497 successful Microsoft 365 sign-ins and more than 200,000 failed attempts. The tokens came from adversary-in-the-middle relays that captured sessions after victims completed MFA, from device-code phishing on Microsoft's real sign-in page, and from social engineering during normal logins. The actor replayed them in bulk, mostly from 193.26.115.0/24 at German host 1337 Services GmbH. For persistence it registered at least 48 rogue [Microsoft Entra ID](https://startwithidentity.com/vendors/iam/microsoft-entra/) devices named `DESKTOP-` plus eight hex characters, and in 19 organizations removed and replaced MFA methods within three hours of the first sign-in. Hidden inbox rules named ".", "sss" and "iT" buried mail, including payroll messages, to set up payment fraud.

## Why it matters

MFA ran every time and still did not stop this. [AiTM phishing](https://startwithidentity.com/techniques/aitm-phishing-proxy/) and [device-code phishing](https://startwithidentity.com/techniques/device-code-phishing/) both end with a valid token, and a password reset does not remove a device or an authenticator the attacker already registered.

Huntress's advice is specific. Revoke sessions and reset passwords, then separately delete unrecognized devices and MFA methods. Treat a [Conditional Access](https://startwithidentity.com/glossary/conditional-access/) block (AADSTS53003) from hosting infrastructure as proof of a valid credential, not a save. Restrict the device code flow to the users who need it and limit user consent to new apps. Hunt for OAuth2:Token sign-ins from hosting providers with `node` or bare `Mozilla/5.0` user agents, and audit inbox rules. Longer term, [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) closes the AiTM path.

Source: [Huntress](https://www.huntress.com/blog/token-replay-spray)