NEW DELHI: A sophisticated cyber campaign lasting approximately ten weeks compromised Microsoft 365 accounts across 79 organizations without attackers ever acquiring the victims’ passwords. Operating between July 14 and September 22, 2026, the perpetrators relied on stolen session tokens to bypass repeated password entries and multi-factor authentication checks, logging 497 successful entries alongside more than 200,000 failed attempts. Cybersecurity researchers discovered that several internet protocol addresses used in the campaign were linked to German hosting provider 1337 Services GmbH, with Microsoft Entra ID Protection independently flagging multiple associated nodes as suspicious.
Mechanisms of Token Theft and Rapid Infiltration
The operation relied on adversary-in-the-middle phishing, device-code deception, and social engineering during routine sign-in routines to intercept authentication data. Fraudulent portals mirrored authentic Microsoft verification pages, capturing session tokens immediately after legitimate users completed multi-factor authentication challenges. Once in possession of these tokens, the perpetrators deployed an automated technique termed token spraying, reusing the intercepted credentials across multiple targets to bypass authentication mechanisms entirely.
Investigators established that the attackers exploited compromised sessions within remarkably narrow windows, gaining access from suspicious servers within 12 minutes of verification on July 21 and in just four minutes on September 22. The intrusion leveraged six distinct addresses within the 193.26.115.0/24 subnet across four phases, rendering single-address blacklisting ineffective against the rotating attack infrastructure.
Persistence Through Rogue Hardware and Authentication Tampering
To retain control beyond the natural expiration of intercepted session tokens, the perpetrators registered at least 48 unauthorized computers within the Microsoft Entra directories of affected organizations. Each device adhered to a standardized naming format combining a desktop prefix with eight hexadecimal characters. Because registered hardware remains embedded in company directories until manually purged by system administrators, these rogue profiles created persistent backdoors for ongoing access.
Network defenses suffered further subversion across at least 19 targeted organizations, where attackers systematically dismantled legitimate authentication methods and registered their own within three hours of initial compromise. In one documented breach, an authenticator application labeled as an iPhone 13 was enrolled less than an hour following the account takeover. Security analysts noted that standard password resets fail to neutralize such incursions unless administrators explicitly remove these unauthorized verification methods and rogue hardware profiles.
Inbox Manipulation and the Effectiveness of Conditional Access
Once inside corporate mailboxes, the perpetrators established covert routing rules using inconspicuous designations such as periods or short letter strings to conceal operational activity. These configurations systematically deleted incoming correspondences, marked communications as read, or diverted sensitive traffic into obscure folders including RSS Feeds and Conversation History. In one instance, attackers utilized a hijacked mailbox to issue payroll instructions to an external accountant before immediately instituting automated filters to hide all incoming replies and terms referencing banking, direct deposits, or bonuses.
The automated reuse of captured tokens expanded significantly on September 11, generating hundreds of successful logins across nearly 30 entities before encountering resilient barriers. A single campaign address recorded 1,052 automated rejections across four specific organizations whose active Conditional Access policies successfully blocked unauthorized attempts. Security analysts emphasized that defending against token-based intrusions requires organizations to enforce strict conditional access parameters, terminate active sessions, eliminate unrecognized hardware registrations, and thoroughly audit mailbox rules alongside conventional password updates.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
