Huntress has published a ten-week Microsoft 365 campaign in which the attackers never guessed a password. They relayed the sign-in, kept the token Microsoft issues after MFA completes, and replayed it from rented hosting.
What happened
Between 14 July and 22 September 2026, Huntress handled related incidents at 79 organisations. Across those environments it recorded 497 successful sign-in events against more than 200,000 failed attempts, all traced to 193.26.115.0/24, a block belonging to German hosting provider 1337 Services GmbH, also known as AS210558.
The technique is adversary-in-the-middle phishing. The victim signs in through a relay that passes the genuine Microsoft pages and MFA prompt straight through, then keeps the session token that Microsoft mints once MFA is satisfied. Because that token was issued after the second factor, holding it is enough to get back in. The operator registered at least 48 rogue Entra devices, wiped and replaced victims' MFA methods, and created inbox rules to hide the replies. In one incident the hijacked mailbox sent a payroll message to an outside contact.
Who is affected
Any Microsoft 365 tenant where Conditional Access does not cover every client type, or does not tie mail access to a managed device.
- Tenants running password plus push notification or SMS as the only second factor, with no device or location condition.
- Tenants that let users register devices in Entra without approval or a compliance check.
- Managed service providers holding delegated admin access into client tenants, where one technician identity reaches every customer.
- Any organisation that has never searched its sign-in logs for token replay patterns.
What to do now
Treat this as a session problem, not a password problem: revoke the sessions, then remove the devices and MFA methods the attacker registered.
- Query Entra sign-in logs for successful events from 193.26.115.0/24, and for the request types OAuth2:Token, Login:reprocess and Cmsi:Cmsi.
- Revoke refresh tokens and reset the password on every affected account.
- Delete unfamiliar Entra-registered devices and reset MFA registration. A password reset on its own leaves both in place.
- Audit inbox rules and forwarding for hidden folders and external redirects, especially around payroll and invoice threads.
- Extend Conditional Access to all client apps and require compliant or hybrid-joined devices for Exchange Online and SharePoint.
What this means for South African businesses
Most local SMEs run Microsoft 365 with MFA switched on and little else, which is precisely the configuration this campaign defeats. A replayed session also survives the password reset an admin performs first, so the mailbox stays open while everyone assumes the incident is closed. My own read is that a small tenant is more exposed than a large one here, because the controls that actually block token replay sit behind Entra ID P1 licensing that many SMEs never buy.
Source: Huntress, M365 token spray and replay campaign compromises business email accounts.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.