# M365 Token Spray and Replay Campaign Compromises Business Email Accounts

AiTM relays and device-code phishing captured post-MFA M365 tokens, replayed from rented 1337 Services IPs to compromise 79 orgs and register rogue MFA/devices.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2026-10-22
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/token-replay-spray
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-token-replay-spray
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:incident platform:threat-intel sev:high tech:azure tech:oauth technique:recon vuln:account-takeover vuln:auth-bypass vuln:mfa-bypass

**Target:** Microsoft Entra ID / M365 sign-in (OAuth2 token endpoint, Device Registration Service, Exchange Online)
**Root cause:** Post-MFA session tokens (refresh/access) are bearer credentials; once stolen via AiTM relay or device-code phishing they can be replayed from any host without re-passing MFA, and MFA methods/devices can be re-registered for persistence.
**Steps:**
1. Victim is lured to an AiTM relay (e.g. `185.238.2[.]195`) that proxies the real Microsoft login and MFA prompt.
2. Relay keeps the issued session token after victim completes MFA.
3. Within minutes attacker replays token from a 1337 Services host (e.g. `193.26.115[.]221`) via `OAuth2:Token` requests using Microsoft Office / Authentication Broker client IDs and `node` user agent.
4. Attacker registers rogue Entra device `DESKTOP-` + 8 hex chars via Device Registration Service.
5. Attacker wipes victim MFA methods via security-info registration service and registers new authenticator labeled "iPhone 13".
6. Attacker creates hidden inbox rules (`.`, `sss`, `s`, `d`) via Outlook REST API to hide payroll/bank mail and moves replies to Conversation History.
7. Attacker uses mailbox for outbound spam/payroll fraud to external contacts.
**How found:** Huntress detected anomalous sign-ins from 193.26.115.0/24 with `node` user agents and DESKTOP-+8hex device names that don't match Windows' default naming (7 alphanumeric), plus OAuth2:Token replays from hosting IPs to Graph/Exchange/Device Registration Service.
**Exploitation:** Two-tier infra: AiTM relays on separate providers capture post-MFA sessions; rented 1337 Services /24 hosts replay them at volume across orgs. Persistence via rogue Entra devices and re-registered authenticators survives password reset; hidden inbox rules enable BEC/payroll fraud. IP rotation across six addresses evaded per-IP blocks.
**Escalation:** Token replay → device registration → MFA method replacement → mailbox rule hiding → outbound payroll fraud; rotated IPs and VPN/rented hosts for post-compromise actions to evade detection.
**Insight:** Hunt for OAuth2:Token and Cmsi:Cmsi sign-ins from hosting ASNs using Microsoft Office/Authentication Broker client IDs with `node` or bare `Mozilla/5.0` UAs; DESKTOP-+8hex device names and MFA wipe-then-reregister within minutes are strong persistence signals. Treat AADSTS53003 as proof of valid credential, not a save.