M365 Token Spray and Replay Campaign Compromises Business Email Accounts

This campaign targeted Microsoft 365 accounts by intercepting sign-in sessions through adversary-in-the-middle (AiTM) relays and replaying stolen authentication tokens. Over a ten-week period, attackers conducted a token spray and replay operation from IP addresses controlled by the German hosting provider 1337 Services GmbH. They achieved 497 successful sign-ins across 79 organizations despite over 200,000 failed attempts. The attackers registered 48 rogue Entra devices within victim environments, replaced multi-factor authentication methods, and created hidden inbox rules to hide malicious communications. The campaign progressed through four distinct phases, utilizing different IP addresses and leveraging both scripted token replay and browser session replay techniques. The ultimate goal was business email compromise, demonstrated by the use of compromised accounts to send fraudulent payroll-related emails to external contacts.

The campaign resulted in unauthorized access to Microsoft 365 accounts across 79 organizations, enabling attackers to bypass MFA, maintain persistent access through rogue devices, and conceal their activities with hidden inbox rules. This allowed for business email compromise, including sending fraudulent emails that could lead to financial loss or reputational damage. The large volume of failed attempts indicates a widespread token spray effort, while the successful sign-ins and persistence mechanisms show a significant breach impact.

No specific patch or fix is applicable as this is a campaign exploiting authentication processes rather than a software vulnerability. Organizations should review and strengthen their Microsoft 365 security configurations, including monitoring for rogue Entra devices, reviewing MFA method changes, and detecting hidden inbox rules. Employing conditional access policies, enabling continuous access evaluation, and using advanced threat protection features can help mitigate such token replay and AiTM attacks. Regularly reviewing sign-in logs for anomalous activity and IP addresses associated with known malicious hosting providers is recommended.