A cyberattacker infiltrated 79 organizations’ Microsoft 365 accounts over 10 weeks, using stolen sign-in sessions to bypass security measures, according to cybersecurity firm Huntress. The stolen sessions were replayed from servers at 1337 Services GmbH, a hosting provider incorporated in Hamburg, Germany, with Microsoft Entra ID Protection flagging several of these addresses independently.
The campaign, which ran from July 14 to September 22, 2026, involved 497 successful sign-ins and over 200,000 failed login attempts. Attackers exploited session tokens, which allowed them to access accounts without needing passwords or re-authenticating through multi-factor authentication (MFA). Over the course of the campaign, the attacker moved between six addresses in the 193.26.115.0/24 range in four phases, with breaks of a week or two between some of them.
How the Attack Worked
Victims were directed to fake sign-in pages using adversary-in-the-middle (AiTM) relays. These pages passed Microsoft’s legitimate login and MFA prompts to users, capturing their session tokens. Tokens were also obtained through device-code phishing and social engineering. In a July 21 incident, the hijacked session appeared from a 1337 Services address just 12 minutes after the victim reached the MFA prompt, demonstrating the attacker’s swift exploitation of stolen tokens.
Read Also: Capcom confirms massive gaming account data breach
Maintaining Access and Hiding Tracks
Once inside an account, the attacker worked to maintain access even after the stolen session expired. Huntress identified 48 rogue computers registered in victims’ Microsoft Entra directories, each named with a pattern like “DESKTOP-“ followed by eight hexadecimal characters. These devices remain in the directory until manually removed.
In 19 organizations, the attacker wiped existing MFA methods and registered new ones within three hours of the initial breach. For example, in the July 21 case, an authenticator app labeled “iPhone 13” was activated on the account less than an hour after the session was hijacked. This method allows attackers to bypass MFA for future sign-ins, even after a password reset, unless the account is audited.
The attacker also created hidden inbox rules to delete or move emails, using names like “.”, “sss”, and “iT”. These rules redirected incoming mail to folders like RSS Feeds and Conversation History, keeping victims unaware of certain communications. In one case, a compromised mailbox was used to send a payroll-related email to an external accountant, with rules set to hide all subsequent correspondence from that accountant.
Read Also: 7 Growth Marketing Strategies for Startups That Can’t Afford to Waste Their Budget
Automated Attacks and Mitigation Efforts
On September 11, the attacker switched to a new address and deployed an automated program to reuse captured tokens. Over four days, this program completed hundreds of successful sign-ins at nearly 30 organizations. The same address was blocked 1,052 times, primarily by four organizations using Conditional Access policies to require MFA or block access outright. These policies proved effective in stopping the attacker’s progress during specific phases of the campaign.
Huntress emphasizes that such policies can address security gaps that MFA alone cannot cover. To assist Microsoft 365 administrators, the firm has published mitigation guidance and indicators of compromise on its blog. This incident shows the need for organizations to adopt full security measures beyond traditional MFA to combat evolving cyber threats.
Leave a Reply