Stolen Microsoft 365 sessions let attackers into accounts at 79 organizations
- Vendor
- Microsoft
Huntress says that from Jul 14 to Sep 22, an attacker replayed stolen Microsoft 365 sign-in tokens to get into accounts at 79 organizations. It needed no passwords and didn’t have to pass MFA again. The tokens came from adversary-in-the-middle relays behind fake sign-in pages, device-code phishing and social engineering. Huntress counted 497 successful sign-ins and more than 200,000 failed attempts traced to one block of addresses at the German host 1337 Services GmbH.
The attacker split the work between relays that captured sessions and hosts that replayed them, Huntress says. On Jul 21, a session caught at a relay was in use from a replay host 12 minutes later, and on Sep 22 the gap was four minutes. Replay moved through six addresses in , one after another, so a block on any single address would have stopped one phase at most. Microsoft Entra ID Protection separately flagged four of them as known threat actor addresses.
Once in, the attacker set up access that outlasts the stolen session. It registered at least 48 rogue Entra devices named DESKTOP- plus eight hexadecimal characters. In 19 organizations, it wiped the victim’s MFA methods and added its own within three hours. A password reset alone leaves both in place, Huntress says.
The attacker also created inbox rules with names like “s” and “sss” that deleted mail or moved it to folders such as RSS Feeds. In one case it sent a payroll-related email to an outside accountant and hid the replies. Every suspicious rule Huntress found came from VPN or rented hosting addresses, never the 1337 Services block.
Conditional Access stopped some of it. In a Sep 11 burst, all 1,052 blocked sign-ins from one replay address came from four organizations, and none of its successful sign-ins landed in them. Huntress says to rank tenants by valid credentials, not by how much they were sprayed.
- Vendor
- Microsoft
What to do
8 steps
Indicators
IPs copy defanged. Use Copy raw for queries.
| Type | Value | Note |
|---|---|---|
| IP address | Token replay and rogue device registration, Jul 14 to Aug 3 | |
| IP address | Browser session replay, July | |
| IP address | Token replay and device-code phishing, from Aug 17 | |
| IP address | Token replay with a bare Mozilla/5.0 user agent, from Aug 17 | |
| IP address | Token replay burst, Sep 11 to 15 | |
| IP address | Browser session replay, Sep 2 to 22 | |
| IP address | Continued a hijacked session in July | |
| IP address | Failed replay of a stolen session in August | |
| IP address | Failed replay of a stolen session in August | |
| IP address | Relay that captured the Jul 21 session | |
| IP address | Relay at Evoxt Sdn. Bhd. used with the Sep 2 to 22 replays | |
| IP address | Created the inbox rules that hid payroll mail | |
| App ID | Device Registration Service; hunt for sign-ins to it from hosting providers |
- IP addressToken replay and rogue device registration, Jul 14 to Aug 3
- Network
- IP addressBrowser session replay, July
- Network
- IP addressToken replay and device-code phishing, from Aug 17
- Network
- IP addressToken replay with a bare Mozilla/5.0 user agent, from Aug 17
- Network
- IP addressToken replay burst, Sep 11 to 15
- Network
- IP addressBrowser session replay, Sep 2 to 22
- Network
- IP addressContinued a hijacked session in July
- Network
- IP addressFailed replay of a stolen session in August
- Network
- IP addressFailed replay of a stolen session in August
- Network
- IP addressRelay that captured the Jul 21 session
- IP addressRelay at Evoxt Sdn. Bhd. used with the Sep 2 to 22 replays
- IP addressCreated the inbox rules that hid payroll mail
- App IDDevice Registration Service; hunt for sign-ins to it from hosting providers
Timeline
- Jul 14Huntress first detects the campaign, in a sign-in from a rogue device registered in the victim’s directory.
- Aug 17After two quiet weeks, the attacker returns from two new addresses and adds device-code phishing.
- Sep 11–15One replay address runs a four-day burst, and Huntress sends incident reports to 22 customers in its first two hours.
- Sep 22Huntress sees the campaign’s last session takeover.
- Oct 22Huntress publishes its findings and indicators.
Sources
- Huntress researchPrimary source huntress.com