Hackers Replayed Stolen Microsoft 365 Sessions Past MFA at 79 Organizations, Then Hid Email in Inbox Rules

For ten weeks this summer, a crew walked into Microsoft 365 accounts that were protected by MFA, without ever having to beat MFA. They stole the session after the victim had already passed the prompt, then replayed those sessions at volume from one block of rented German IP addresses.

Between July 14 and September 22, Huntress detected 497 successful sign ins across 79 victim organizations. It traced more than 200,000 failed login attempts in the same window to the 193.26.115.0/24 range owned by 1337 Services GmbH, a Hamburg hosting provider. Huntress calls the technique token spraying: password spraying, but with stolen tokens.

Stealing the session, not the password

Most of the tokens came from adversary in the middle relays. These sit between the victim and Microsoft, pass the real login page and MFA prompt through, and keep the token Microsoft issues once MFA succeeds. Whoever holds that token does not need MFA again. It is the same trick behind kits like Milk Dragon, which steals one time codes to bypass MFA.

Other tokens came from device code phishing, where the victim types a code on Microsoft's real page and unknowingly authorizes the attacker, and from plain social engineering.

The crew got faster. On July 21, the gap between a victim reaching the MFA prompt and the hijacked session showing up from a 1337 address was 12 minutes. By September 22 it was four.

Built to survive a password reset

Once inside, the attackers dug in. Huntress found at least 48 rogue Entra devices named DESKTOP plus eight hex characters. In one account, a new authenticator labeled "iPhone 13" appeared about 50 minutes after the token was captured. In 19 organizations, the victim's MFA methods were wiped and a new one registered within three hours of the first sign in.

That matters because a registered authenticator survives a password reset unless someone removes it.

Then came the inbox rules, with throwaway names like ".", "sss", "s" and "d". They moved or deleted mail into folders nobody checks, such as RSS Feeds or Conversation History. One rule caught any message mentioning payroll, direct deposit, bank or bonus. Five minutes later, a second rule hid all mail from an external accountant, and the attacker used the account to send that accountant a payroll related email.

In another mailbox, a rule marked every incoming message read and deleted it, while the account sent spam to hundreds of outside recipients. The rules were always created from VPNs or other rented hosts, never from the 1337 range.

What actually stopped it

The operator rotated through six addresses in the range, one phase after another, so blocking a single address did nothing against the next. Microsoft Entra ID Protection flagged four of them individually as known threat actor IPs.

The clearest signal came on September 11. One address made 303 successful sign ins across 29 organizations over four days. It also logged 1,052 blocked sign ins, all at just four organizations that had Conditional Access set up, with no overlap with the ones it got into. Ranking tenants by failed attempts, Huntress notes, would have sent responders to the four places where defenses were already working.

Huntress also warns that a Conditional Access block is a sign the stolen credential was valid, not a save. Its cleanup guidance is to revoke sessions along with the password reset, because a reset alone leaves access tokens valid for about 90 minutes and leaves rogue devices and MFA methods in place. Responders also need to audit devices, MFA methods and inbox rules, restrict device code flow, and require MFA for all users, apps and client types through Conditional Access.

Huntress does not name the group behind the campaign or the organizations it hit.

Some offers on this page may be paid placements or contain affiliate links.