---
title: Hunt: M365 "token spraying" from 193.26.115.0/24 hit 79 orgs: rogue DESKTOP-xxxxxxxx Entra devices, wiped MFA and one-character inbox rules | ctxsec
url: https://ctxsec.com/items/hunt-huntress-m365-token-spray-1337-services
description: ""
status: "confirmed research (Huntress, Oct 22; campaign Jul 14 to Sep 22)"
published: 2026-10-22
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-huntress-m365-token-spray-1337-services.md)

confirmed research (Huntress, Oct 22; campaign Jul 14 to Sep 22)

2026-10-22

### Hunt: M365 "token spraying" from 193.26.115.0/24 hit 79 orgs: rogue DESKTOP-xxxxxxxx Entra devices, wiped MFA and one-character inbox rules

Huntress tracked a ten-week campaign that stole post-MFA Microsoft 365 sessions through adversary-in-the-middle relays, device-code phishing and social engineering, then replayed the tokens at volume from hosts at **1337 Services GmbH (AS210558)**. It saw **497** successful sign-ins at **79** organizations against 200,000+ failed attempts. The gap between a victim hitting the MFA prompt and the replay was 12 minutes in July and four by September.

- **Replay hosts:** `193.26.115[.]221`, `.199`, `.16`, `.21`, `.72`, `.210`, plus `124.198.132[.]33`, `45.83.31[.]44`, `192.159.99[.]172`. AiTM relays: `185.238.2[.]195` and `2400:8d60:2::1:841d:5dd` (Evoxt).
- **Sign-in logs:** `OAuth2:Token` or `Cmsi:Cmsi` requests from hosting IPs using the Microsoft Office (`d3590ed6-...`) or Authentication Broker (`29d9ed98-...`) client with a `node` or bare `Mozilla/5.0` user agent, especially against the Device Registration Service (`01cb2876-...`).
- **Devices:** 48 rogue Entra-joined devices named `DESKTOP-` plus exactly **eight uppercase hex** characters (Windows defaults to seven alphanumerics).
- **MFA:** methods wiped and a new authenticator (label "iPhone 13") registered within minutes; in 19 orgs this happened within three hours of first replay.
- **Mailbox:** rules named `.`, `sss`, `ss`, `iT`, `s`, `d` that move mail to RSS Feeds, RSS Subscriptions or Conversation History, or hide payroll and bank keywords; some were created through the Outlook REST API from VPN or rented hosting.
- **Triage tip:** AADSTS53003 (blocked by Conditional Access) means the credential was valid. Prioritize tenants by successful sign-ins, not spray volume: in one phase all 1,052 blocks hit four orgs while the successes landed in 28 others.

Sources: [Huntress: M365 Token Spray and Replay Campaign Compromises Business Email Accounts (Oct 22)](https://www.huntress.com/blog/token-replay-spray)