Microsoft 365 Adversary-in-the-Middle Token Replay Campaign

Between July 14 and September 22, 2026, threat actors conducted a widespread campaign targeting Microsoft 365 users. The attackers utilized Adversary-in-the-Middle (AitM) infrastructure to intercept login credentials and MFA codes, allowing them to capture valid session tokens. These tokens were subsequently replayed to gain access to corporate mailboxes without triggering MFA. The campaign resulted in the compromise of 97 accounts across 79 organizations, with observed persistence mechanisms including the registration of rogue Entra devices and the addition of unauthorized MFA methods.

Attack Chain

1. Victims are directed to a malicious AitM login page that proxies communication with legitimate Microsoft services.
2. The AitM proxy captures the victim's credentials, MFA inputs, and the resulting valid session access token.
3. Attackers replay the captured access token from their own infrastructure within minutes to hijack active sessions.
4. Attackers gain unauthorized access to Microsoft 365 services and proceed to establish long-term persistence.
5. Attackers register rogue Entra devices and add unauthorized authenticator apps to maintain access even after session expiration.
6. Attackers configure hidden inbox rules to delete or hide sensitive communications (e.g., payroll, bonus) and distribute outbound spam.

Impact

The campaign successfully compromised 97 accounts across 79 organizations. Attackers registered at least 48 fake devices in victim directories and leveraged compromised mailboxes for outbound spam campaigns. Specific inbox rules were used to obfuscate activity and hide incoming financial communications.

Recommendation

• Restrict the device-code authentication workflow using Microsoft Entra Conditional Access policies to prevent unauthorized device registration.
• Audit Microsoft Entra directories for unauthorized or suspicious registered devices.
• Review and enforce MFA requirements using Conditional Access policies for all users, all cloud apps, and all client app types unconditionally.
• Implement periodic audits of inbox rules across the environment, specifically searching for rules with minimal naming or obscured characters.
• Immediately revoke active sessions and reset credentials for any accounts identified with suspicious MFA registration activity.