Hackers infiltrated 79 organizations using Microsoft 365 sessions, altering multifactor authentication methods and registering unauthorized devices to maintain access. Huntress monitored the campaign from July 14 to September 22, 2026, noting 497 successful sign-ins and over 200,000 failed login attempts linked to the attackers' infrastructure. Its main replay servers operated from six IP addresses within the 193.26.115[.
]0/24 range, which belonged to German hosting provider 1337 Services GmbH.
By replaying multiple stolen authentication tokens across various organizations, they were able to reuse a victim's completed login without prompting for additional multi-factor authentication (MFA). In relay attacks, a fake sign-in page intercepted and captured the session details, while device-code phishing tricked users into authorizing the attacker's session through Microsoft's legitimate sign-in page. Build A utilized automated OAuth2:Token requests, typically with the node user agent, against Microsoft Graph, Exchange Online, SharePoint Online, and the Device Registration Service.
Consequently, blocking a replay address wouldn't prevent phishing relays from stealing additional sessions, while removing a relay wouldn't eliminate tokens already captured. Some rules targeted payroll and banking terms. Key indicators of compromise include: - IP range: 193.26.115[.
]0/24, hosted by 1337 Services GmbH, AS210558 - IP address: 193.26.115[. ]221, involved in token replay and rogue device registration from July 14 to August 3 - Note: IP addresses and domains are defanged to prevent accidental resolution or hyperlinking.
