Huntress tracked a ten-week campaign that stole post-MFA Microsoft 365 sessions through adversary-in-the-middle relays, device-code phishing and social engineering, then replayed the tokens at volume from hosts at 1337 Services GmbH (AS210558). It saw 497 successful sign-ins at 79 organizations against 200,000+ failed attempts. The gap between a victim hitting the MFA prompt and the replay was 12 minutes in July and four by September.

• Replay hosts: 193.26.115[.]221, .199, .16, .21, .72, .210, plus 124.198.132[.]33, 45.83.31[.]44, 192.159.99[.]172. AiTM relays: 185.238.2[.]195 and 2400:8d60:2::1:841d:5dd (Evoxt).
• Sign-in logs: OAuth2:Token or Cmsi:Cmsi requests from hosting IPs using the Microsoft Office (d3590ed6-...) or Authentication Broker (29d9ed98-...) client with a node or bare Mozilla/5.0 user agent, especially against the Device Registration Service (01cb2876-...).
• Devices: 48 rogue Entra-joined devices named DESKTOP- plus exactly eight uppercase hex characters (Windows defaults to seven alphanumerics).
• MFA: methods wiped and a new authenticator (label "iPhone 13") registered within minutes; in 19 orgs this happened within three hours of first replay.
• Mailbox: rules named ., sss, ss, iT, s, d that move mail to RSS Feeds, RSS Subscriptions or Conversation History, or hide payroll and bank keywords; some were created through the Outlook REST API from VPN or rented hosting.
• Triage tip: AADSTS53003 (blocked by Conditional Access) means the credential was valid. Prioritize tenants by successful sign-ins, not spray volume: in one phase all 1,052 blocks hit four orgs while the successes landed in 28 others.