M365 token spray and replay: Huntress tracks a 10-week campaign that replays stolen post-MFA tokens from rented hosting within minutes, registers rogue Entra devices, wipes and re-registers MFA methods and hides mail with inbox rules of one to three characters or punctuation only
Huntress: stolen post-MFA M365 tokens replayed within minutes; a password reset leaves planted devices and MFA methods
Defender actions
- In every Entra tenant, list the devices registered since 2026-07-14 whose names are DESKTOP- followed by eight uppercase hexadecimal characters, the authenticators that were deleted and re-registered within minutes, and the inbox rules whose names are one to three characters or punctuation only or that move mail to RSS Feeds, RSS Subscriptions or Conversation History, and remove what nobody created; then revoke the sessions of any affected user, because a password reset leaves the devices, MFA methods and a roughly 90-minute access token in place.
Analysis
Between 2026-07-14 and 2026-09-22 Huntress detected 497 Microsoft 365 sign-in events across 79 victim organizations that replayed stolen sign-in tokens instead of guessing passwords (Huntress, 2026-10-22). The tokens came from adversary-in-the-middle relays behind fake sign-in pages, from device-code phishing and from social engineering during a genuine sign-in; a relay passes the real login page and MFA prompt through and keeps the token Microsoft issues afterwards, so its holder does not face MFA again (Huntress, 2026-10-22). Replay followed within minutes, after 12 minutes on 2026-07-21 and four minutes on 2026-09-22, from one of six addresses in a single rented range used in turn, so blocking one address stops at most one phase (Huntress, 2026-10-22).
A scripted replayer with the user agent node requests tokens with the Microsoft Office and Microsoft Authentication Broker client applications against Microsoft Graph, Exchange Online, SharePoint Online and the Device Registration Service and joins 48 rogue Entra devices named DESKTOP- plus exactly eight uppercase hexadecimal characters, where the Windows default is seven alphanumeric characters; a browser-session replayer uses current Chrome or Edge through the OfficeHome client (Huntress, 2026-10-22). What outlives a password reset is the persistence: in 19 organizations the victim's MFA methods were wiped and a new authenticator registered within three hours, the rogue devices stay in the directory until deleted, and hidden inbox rules with names of one to three characters or punctuation only, created from VPN or other rented addresses, moved mail to RSS Feeds, RSS Subscriptions or Conversation History or deleted it, one keyed on payroll and bank terms (Huntress, 2026-10-22). Conditional Access blocks reported as AADSTS53003 fire only after authentication has succeeded, so they signal a valid credential, and ranking tenants by failed attempts points responders at the wrong ones (Huntress, 2026-10-22).
Triage: a node user agent with an Office client identifier can be legitimate automation, so Huntress focuses on sign-ins that touch user mailboxes or the Device Registration Service from hosting infrastructure, and it says the device-name pattern is rare but not unique to this campaign, so a device should be confirmed before it is deleted (Huntress, 2026-10-22).
Cited evidence
Between July 14, 2026 and September 22, 2026, Huntress detected 497 Microsoft 365 sign-in events across 79 victim organizations related to a token replay campaign
In 19 organizations, the victim's existing MFA methods were wiped and a new method registered within three hours of the first sign-in from a campaign address.
A password reset alone does not remove attacker-registered devices or MFA methods.
Sources1
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.