Huntress has published research that reframes the way business email compromise gets into an organization. In a report published on 22 October 2026, the managed security provider describes a Microsoft 365 campaign that ran from 14 July to 22 September 2026, in which attackers never needed to guess a single password. Instead, they captured sign in sessions through adversary in the middle relays and replayed the stolen tokens at scale, a technique Huntress calls token spraying.
Across its customer environments, Huntress responded to incidents at 79 organizations, observing at least 497 successful Microsoft 365 sign in events against more than 200,000 failed login attempts, all traced back to the 193.26.115[.]0/24 IP range attributed to German hosting provider 1337 Services GmbH, also known as AS210558. Microsoft Entra ID Protection independently raised verified threat actor IP detections against several addresses in that range.
How token spraying works
In an adversary in the middle attack, the victim signs in through a relay that sits between them and the real Microsoft login page. The relay passes the genuine page and the MFA prompt through to the victim, then keeps the token Microsoft issues once the sign in finishes. Because that token is minted after MFA, whoever holds it does not need to pass MFA again. The attacker then replayed many stolen tokens in automated sign in attempts against Microsoft 365 services, the same volume pattern as password spraying but with stolen tokens instead of guessed passwords.
Huntress says the tokens came from multiple sources: AiTM relays behind fake sign in pages, device-code phishing, and social engineering during an otherwise legitimate login process.
Persistence and mailbox manipulation
Once inside, the attackers worked to stay inside. They registered at least 48 rogue Entra devices in victim directories, because a registered device gives a more durable way to request tokens than a stolen session alone. They also wiped and replaced victims’ MFA methods. In one case described by the researchers, an attacker activated a new authenticator app within roughly an hour of hijacking a session.
The email specific details deserve the most attention. The attackers created hidden inbox rules with names such as “sss”, “ss” and “iT” to delete incoming mail referencing payroll, deposits and bonuses, or to move it into obscure folders like RSS Feeds and Conversation History. The goal was to hide the replies and warnings that would expose an ongoing business email compromise. In one compromised mailbox, the attacker marked all incoming messages as read and deleted them, then used the account to send outbound spam to hundreds of external recipients before Microsoft Entra ID Protection rated the account high risk. In another incident, the attacker used a hijacked account to send a payroll related email to an outside contact.
Why DMARC still matters when the attack starts inside
The instinctive reading of this campaign is that email authentication was irrelevant, because the attacker used real accounts on real infrastructure. The opposite is true. Attacks that begin with a stolen token end with a stolen mailbox, and a stolen mailbox sends mail that passes SPF, DKIM and DMARC for the domain it belongs to. Authentication cannot tell you the human behind the send was replaced.
That has two consequences. For defenders, inbound authentication is the floor: a message that passes DMARC is not automatically safe, and controls like Conditional Access, session revocation and inbox rule auditing have to catch what happens after delivery. Huntress recommends revoking sessions and resetting the password of any suspected token replay victim, then removing attacker registered devices and MFA methods, which a password reset alone leaves in place, and reviewing inbox rules and new enterprise applications.
For senders, the outbound side is the dangerous part. A hijacked mailbox that spams hundreds of external recipients does reputation damage to the domain it sends from. The brand whose domain was conscripted into the fraud absorbs the bounce, complaint and blocklist consequences, even though nobody on its team wrote the messages.
The deliverability lesson
For marketing and IT teams, the campaign is a reminder that deliverability and security converge on the same asset: the domain. If your domain sends mail from accounts that can be quietly taken over, your sender reputation is only as strong as your weakest session token. Monitoring DMARC aggregate reports remains essential, not because it stops token theft, but because it shows you every source sending as your domain, including compromised accounts and any unauthorized service that slipped into your DNS.
Excello Mail maps every legitimate sending source for your domains and takes you to full DMARC enforcement without breaking real mail, and its monitoring surfaces sending that does not belong, whether it comes from a spoofed domain or from a mailbox that no longer answers to you. Sign up for free to Excello Mail and keep your domain, your recipients and your reputation out of someone else’s attack.