---
title: Tip: a password reset does not end a token-replay compromise. Revoke sessions, then delete rogue devices and MFA methods | ctxsec
url: https://ctxsec.com/items/tip-contain-m365-token-replay-revoke-devices-mfa
description: ""
status: "guidance based on Huntress research (Oct 22)"
published: 2026-10-22
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-contain-m365-token-replay-revoke-devices-mfa.md)

guidance based on Huntress research (Oct 22)

2026-10-22

### Tip: a password reset does not end a token-replay compromise. Revoke sessions, then delete rogue devices and MFA methods

In the Huntress token-spraying campaign, attackers kept access through registered Entra devices and their own authenticator app, both of which survive a password reset, and access tokens stay valid for roughly 90 minutes unless sessions are revoked.

- **Contain:** revoke the user's sessions _and_ reset the password, then remove devices and MFA methods the user doesn't recognize.
- **Prevent:** require MFA or block for all users, all cloud apps and all client app types; restrict device-code flow with a Conditional Access authentication-flows policy; turn off user consent to new enterprise apps.
- **Review:** look for MFA cleared and re-registered within minutes, inbox rules with one-to-three-character or punctuation names, and new enterprise app grants.

Sources: [Huntress: M365 Token Spray and Replay Campaign Compromises Business Email Accounts (Oct 22)](https://www.huntress.com/blog/token-replay-spray)