Affected Systems

Microsoft 365 / Entra ID users across 79 organizations. Campaign active July 14 - September 22, 2026. 497 successful sign-ins from 200,000+ attempts originating from 193.26.115.0/24 IP range. 48 rogue Entra devices registered.

Exploitation Status

Active exploitation confirmed. Huntress observed live campaign between July and September 2026 with 97 compromised accounts. Attackers used adversary-in-the-middle (AitM) phishing pages to steal session tokens, then replayed them at scale ("token spraying"). Attack infrastructure linked to Romanian IP 193.26.115.221 and German hosting provider 1337 Services GmbH (associated with StarkRDP/rdp.sh virtual server rentals).

Business Impact

Token replay attacks bypass MFA entirely by stealing post-authentication session tokens. Attackers established persistence within 3 hours by adding rogue MFA methods (authenticator apps) and registering fake devices in Entra ID. Hidden inbox rules deleted or moved emails containing payroll/financial keywords. One compromised mailbox sent spam to hundreds of recipients. Traditional password resets alone do not remediate this attack—session tokens and device registrations must be revoked. Organizations using Microsoft 365 without Conditional Access Policies restricting device registration and device-code flows are at elevated risk.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit all Entra ID registered devices for unfamiliar entries (e.g., 'iPhone 13' or generic names) and remove unauthorized devices from the directory.
  • Review MFA methods for all users—remove any authenticator apps or methods added without user knowledge, especially within 3 hours of suspicious sign-ins.
  • Check mailbox inbox rules for all users for hidden or suspicious names (e.g., '.', 'sss', 'iT', '........') that delete or move messages; delete unauthorized rules.
  • Revoke all active Microsoft 365 sessions for affected accounts, force password resets, and re-register MFA from trusted devices only.
  • Implement Conditional Access Policies requiring MFA for all users, all cloud apps, all client types, and restrict device-code authentication workflow to prevent token phishing.
  • Block or monitor traffic from 193.26.115.0/24 IP range and review sign-in logs for login attempts from 1337 Services GmbH / StarkRDP / exy.sh hosting infrastructure.
  • Enable Microsoft Entra ID Protection risk-based policies to automatically flag and block high-risk sign-ins and compromised accounts.