Ethical Hacking News
Token spraying, a sophisticated phishing attack, has compromised 97 Microsoft 365 accounts across 79 organizations. The attack exploits vulnerabilities in Microsoft 365's sign-in process and highlights the importance of robust security measures and regular security policy updates.
The token spraying attack compromised 97 Microsoft 365 accounts across 79 organizations.The attack exploits a vulnerability in Microsoft 365's sign-in process, using an AitM relay to capture credentials and MFA codes.The attackers replayed stolen tokens to gain unauthorized access to email accounts, often using authenticator apps as a form of persistence.The attackers registered new MFA methods in some cases, and set up hidden email rules to delete or move incoming mail.The tokens used in the attack originated from multiple sources, including fake sign-in pages, device-code phishing, and social engineering.The attack highlights the importance of robust security measures, including revoking sessions, resetting passwords, and regularly reviewing security policies.
A recent threat intelligence report has shed light on a sophisticated phishing attack that has compromised the security of 97 Microsoft 365 accounts across 79 organizations. The attack, dubbed "token spraying," utilizes a complex relay mechanism to capture sign-in sessions and then replay the stolen tokens to gain unauthorized access to email accounts. This report will delve into the intricacies of the token spraying attack, its methods, and the potential consequences for organizations.
The token spraying attack exploits a vulnerability in Microsoft 365's sign-in process, where an adversary-in-the-middle (AitM) relay is used to capture the entered credentials and MFA codes. The attacker then relays this information to the real login page, allowing them to collect the access token issued by Microsoft following the sign-in process. This token is subsequently replayed by the attacker from their own devices within minutes to conduct automated sign-in attempts against Microsoft 365 services.
The approach employed by the attackers is analogous to password spraying, where the attacker replays many stolen tokens at scale across several organizations. In some cases, the attackers have even added their own authenticator app as a form of persistence to complete MFA challenges for new sign-ins and overcome scenarios where the stolen session token expires or gets revoked by the victim.
In 19 organizations, the attackers have removed the victim's existing MFA methods and registered a new method within three hours of the first sign-in. In one case observed on July 21, 2026, the threat actors activated a new authenticator app named "iPhone 13" less than 51 minutes after the session was hijacked. The attackers have also set up hidden email rules in victims' inboxes to delete incoming mail with certain keywords or move them to obscure folders.
The tokens used in the attack originate from multiple sources, including AitM relays behind fake sign-in pages, device-code phishing, and social engineering during a legitimate login process. The campaign was first observed from a Romanian IP address 193.26.115[.]221, which is associated with a remote access trojan called AsyncRAT. The IP address is linked to a German hosting provider named 1337 Services GmbH, which has been flagged as malicious and suspicious.
The attack highlights the importance of robust security measures, including revoking sessions, resetting passwords, auditing Entra devices, reviewing MFA methods, and restricting device-code workflow with Conditional Access policies. Organizations must also ensure that their security policies are regularly reviewed and updated to prevent similar attacks from occurring.
In conclusion, the token spraying attack is a sophisticated phishing attack that exploits Microsoft 365 vulnerabilities to compromise email accounts across 79 organizations. The attack highlights the importance of robust security measures and the need for organizations to regularly review and update their security policies.
Related Information:
https://www.ethicalhackingnews.com/articles/Token-Spray-A-Sophisticated-Phishing-Attack-Exploits-Microsoft-365-Vulnerabilities-to-Compromise-97-Accounts-Across-79-Organizations-ehn.shtml
https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html
Published: Mon Oct 26 13:02:07 2026 by llama3.2 3B Q4_K_M
