Huntress tracks stolen-session replay into 79 Microsoft 365 organizations without a password
Huntress reported on October 22 that one actor replayed tokens stolen by AiTM and device-code phishing into 79 organizations between July 14 and September 22, registering rogue Entra devices and swapping MFA methods within hours to survive password resets.
Huntress said on October 22 that it had responded to one campaign at 79 organizations between July 14 and September 22, with at least 497 successful Microsoft 365 sign-ins and more than 200,000 failed attempts. The tokens came from adversary-in-the-middle relays that captured sessions after victims completed MFA, from device-code phishing on Microsoft's real sign-in page, and from social engineering during normal logins. The actor replayed them in bulk, mostly from 193.26.115.0/24 at German host 1337 Services GmbH. For persistence it registered at least 48 rogue Microsoft Entra ID devices named DESKTOP- plus eight hex characters, and in 19 organizations removed and replaced MFA methods within three hours of the first sign-in. Hidden inbox rules named ".", "sss" and "iT" buried mail, including payroll messages, to set up payment fraud.
Why it matters
MFA ran every time and still did not stop this. AiTM phishing and device-code phishing both end with a valid token, and a password reset does not remove a device or an authenticator the attacker already registered.
Huntress's advice is specific. Revoke sessions and reset passwords, then separately delete unrecognized devices and MFA methods. Treat a Conditional Access block (AADSTS53003) from hosting infrastructure as proof of a valid credential, not a save. Restrict the device code flow to the users who need it and limit user consent to new apps. Hunt for OAuth2:Token sign-ins from hosting providers with node or bare Mozilla/5.0 user agents, and audit inbox rules. Longer term, phishing-resistant MFA closes the AiTM path.
Source: Huntress
Related on Start with Identity
- BlogOne ConnectWise app credential opened Microsoft 365 tenants across MSP customers
Huntress found an attacker signing in as the ConnectWise Cloud Backup (formerly SkyKick) Entra app with a stolen app credential, pulling Microsoft Graph tokens
- BlogAuthMask flaw let any Android app pull work-account tokens from Microsoft Authenticator
Enclave disclosed on October 23 that Microsoft Authenticator for Android trusted a caller's claimed identity, so a zero-permission app could pose as Teams and r
- BlogInfostealers are draining Claude subscriptions with stolen session cookies, no password needed
Anthropic warned that commodity infostealers are lifting Claude session cookies from browsers and replaying them to drain paid usage. No password, no MFA prompt
- CVEKeycloak SAML broker assertion replay, session hijack
Keycloak's SAML broker accepted a replayed assertion and hijacked a user session. An authentication bypass on the broker edge. Patched in the 2026 Keycloak SAML
- ArticleB2B vs B2C CIAM: Tenancy, Organizations, and Architecture
B2B and B2C customer identity share a name but differ in architecture. This guide explains the organization and tenancy model, who administers users, and why ch
- RankingBest Password Managers for Business: Top 5
The best business password managers in 2026: Bitwarden, Keeper, Dashlane, NordPass, and Zoho Vault. Ranked for team sharing, admin controls, SSO, and value.