Search — “token spray”
1 story · 0 IoCs
Stories
P1
M365 token spray/replay campaign from 1337 Services /24 hijacks post-MFA sessions at 79 orgs
Huntress tracked a ten-week campaign (Jul 14–Sep 22, 2026) where AiTM relays and device-code phishing captured post-MFA M365 sessions, then replayed tokens from 193.26.115.0/24 (1337 Services GmbH, AS210558), yielding 497 successful sign-ins at 79 orgs. Persistence came via rogue Entra devices named DESKTOP-+8 uppercase hex, wiped-and-replaced MFA methods, and hidden inbox rules with short/punctuation names used for BEC/payroll fraud. Hunt for OAuth2:Token/Cmsi:Cmsi sign-ins with node or bare Mozilla/5.0 UA from hosting IPs, Device Registration Service sign-ins, MFA wipe+re-register within minutes, and inbox rules moving mail to RSS Feeds/Conversation History.