An unidentified threat actor conducted a ten-week campaign between July and September 2026 targeting Microsoft 365 tenants. The operation leveraged adversary-in-the-middle (AiTM) phishing relays to capture authentication sessions and subsequently replayed stolen session tokens to gain unauthorized access to business email accounts. The campaign resulted in 79 organizations compromised and 497 successful malicious sign-ins.
This activity represents a growing trend in identity-based attacks where adversaries bypass multi-factor authentication by stealing session cookies rather than passwords. The use of infrastructure hosted by German provider 1337 Services GmbH for token replay operations indicates deliberate infrastructure selection to blend malicious traffic with legitimate European business communications.
Threat Actor / Malware Profile
Adversary Attribution: Unknown threat actor with capabilities consistent with financially motivated BEC groups or initial access brokers.
Attack Chain:
- Initial Access: AiTM phishing relays intercept user credentials and session tokens during legitimate authentication flows
- Execution: No traditional malware deployment; attack operates entirely through identity layer abuse
- Persistence: Stolen session tokens provide persistent access until token expiration or revocation
- Exfiltration: Compromised mailboxes likely used for BEC fraud, data theft, or downstream phishing
Anti-Analysis Techniques:
- Use of legitimate hosting providers to evade IP reputation-based blocking
- Token replay eliminates the need for repeated phishing, reducing detection surface
- Operations conducted during business hours to blend with legitimate user activity
IOC Analysis
The pulse contains four indicators requiring immediate operationalization:
| Indicator | Type | Context |
|---|---|---|
| d8a3fedb1a3cd1287ca47c6851a49e6052ab6116b43666e674765ca892d798ce | FileHash-SHA256 | Suspected AiTM phishing kit or related tooling |
| 185.238.2.195 | IPv4 | Token replay source — 1337 Services GmbH |
| 192.159.99.172 | IPv4 | Token replay source — 1337 Services GmbH |
| 2400:8d60:2::1:841d:5dd | IPv6 | Token replay source — 1337 Services GmbH |
SOC Operationalization:
- Block listed IPs at perimeter firewalls, email gateways, and cloud access security brokers (CASB)
- Add SHA256 hash to endpoint detection and response (EDR) blocklists
- Alert on any authentication events originating from listed IPs in Azure AD sign-in logs
- Correlate with impossible travel alerts and anomalous token usage patterns
Detection Engineering
YAML
---
title: Microsoft 365 AiTM Token Replay Detection
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
description: Detects authentication attempts using replayed session tokens from suspicious IP ranges associated with known AiTM campaigns
status: experimental
date: 2026/10/24
author: Security Arsenal Threat Intelligence
references:
- https://www.huntress.com/blog/token-replay-spray
logsource:
product: azure
service: signinlogs
detection:
selection_ip:
ip_address:
- '185.238.2.195'
- '192.159.99.172'
- '2400:8d60:2::1:841d:5dd'
selection_token_replay:
authentication_protocol: 'token'
token_issuer_type: 'AzureAD'
condition: selection_ip or selection_token_replay
falsepositives:
- Legitimate users accessing from VPN exit nodes in listed IP ranges
level: high
tags:
- attack.t1557
- attack.t1539
- attack.t1078
---
title: Suspicious Azure AD Token Issuance Outside Normal Geography
id: 8b7c6d5e-4f3a-2b1c-0d9e-8f7a6b5c4d3a
description: Identifies session token issuance or validation from IP addresses geolocated to high-risk hosting providers
status: experimental
date: 2026/10/24
author: Security Arsenal Threat Intelligence
logsource:
product: azure
service: signinlogs
detection:
selection:
result_type: 0
filter_geo:
location_country: 'DE'
ip_address|contains:
- '185.238.2'
- '192.159.99'
condition: selection and filter_geo
falsepositives:
- German-based employees
- Corporate VPN endpoints in Germany
level: medium
tags:
- attack.t1078
- attack.t1550
---
title: Multiple Failed Followed by Successful AiTM Authentication
id: 7c6d5e4f-3a2b-1c0d-9e8f-7a6b5c4d3a2b
description: Detects pattern of failed authentication attempts followed by successful token-based login, indicative of AiTM relay attacks
status: experimental
date: 2026/10/24
author: Security Arsenal Threat Intelligence
logsource:
product: azure
service: signinlogs
detection:
selection_failed:
result_type: 50126
selection_success:
result_type: 0
authentication_protocol: 'token'
condition: selection_failed | count() > 3 by user_principal_name | selection_success
timeframe: 15m
falsepositives:
- Users mistyping passwords before successful login
level: high
tags:
- attack.t1110
- attack.t1557
KQL — Microsoft Sentinel / Defender
// Hunt for AiTM token replay indicators in Azure AD sign-in logs
let suspicious_ips = dynamic(['185.238.2.195', '192.159.99.172', '2400:8d60:2::1:841d:5dd']);
SigninLogs
| where TimeGenerated >= ago(90d)
| where IPAddress in (suspicious_ips)
| project TimeGenerated, UserPrincipalName, IPAddress, Location,
AuthenticationProtocol, ResultType, ResultDescription,
AppDisplayName, DeviceDetail, TokenIssuerType
| extend IsTokenReplay = iff(AuthenticationProtocol == 'token' and TokenIssuerType == 'AzureAD', true, false)
| summarize SignInCount = count(),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
UniqueUsers = dcount(UserPrincipalName)
by IPAddress, ResultType, IsTokenReplay
| order by SignInCount desc
// Correlate with impossible travel patterns
let suspicious_logins = SigninLogs
| where TimeGenerated >= ago(30d)
| where ResultType == 0
| project UserPrincipalName, IPAddress, Location, TimeGenerated;
suspicious_logins
| join kind=inner suspicious_logins on UserPrincipalName
| where TimeGenerated1 > TimeGenerated
| where Location != Location1
| extend TimeDelta = datetime_diff('minute', TimeGenerated1, TimeGenerated)
| where TimeDelta < 60 and Location != Location1
| project UserPrincipalName, IPAddress, Location, TimeGenerated,
IPAddress1, Location1, TimeGenerated1, TimeDelta
| order by TimeDelta asc
PowerShell
# AiTM Token Replay IOC Hunt Script
# Run on domain controllers and Azure AD Connect servers
$SuspiciousIPs = @('185.238.2.195', '192.159.99.172', '2400:8d60:2::1:841d:5dd')
$SuspiciousHash = 'd8a3fedb1a3cd1287ca47c6851a49e6052ab6116b43666e674765ca892d798ce'
$Report = @()
Write-Host '[+] Starting AiTM Token Replay IOC Hunt...' -ForegroundColor Cyan
# Check network connections to suspicious IPs
Write-Host '[+] Checking active network connections...' -ForegroundColor Yellow
$NetConnections = Get-NetTCPConnection | Where-Object { $SuspiciousIPs -contains $_.RemoteAddress }
if ($NetConnections) {
$Report += [PSCustomObject]@{
Check = 'Network Connection'
Status = 'ALERT'
Details = ($NetConnections | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State | Out-String)
}
}
# Check DNS cache for resolution of suspicious infrastructure
Write-Host '[+] Checking DNS cache...' -ForegroundColor Yellow
$DNSCache = Get-DnsClientCache | Where-Object { $_.Entry -match '1337|token|relay|proxy' }
if ($DNSCache) {
$Report += [PSCustomObject]@{
Check = 'DNS Cache'
Status = 'REVIEW'
Details = ($DNSCache | Select-Object Entry, Data | Out-String)
}
}
# Hunt for suspicious file hash
Write-Host '[+] Scanning for suspicious file hash...' -ForegroundColor Yellow
$Paths = @('C:\Users', 'C:\ProgramData', 'C:\Windows\Temp')
foreach ($Path in $Paths) {
$Files = Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue |
Select-Object -First 1000
foreach ($File in $Files) {
try {
$Hash = Get-FileHash -Path $File.FullName -Algorithm SHA256 -ErrorAction Stop
if ($Hash.Hash -eq $SuspiciousHash) {
$Report += [PSCustomObject]@{
Check = 'File Hash Match'
Status = 'CRITICAL'
Details = "File: $($File.FullName)"
}
}
} catch { }
}
}
# Check Windows Event Logs for suspicious authentication patterns
Write-Host '[+] Analyzing security event logs...' -ForegroundColor Yellow
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624,4625} -MaxEvents 5000 |
Where-Object { $_.Message -match ($SuspiciousIPs -join '|') }
if ($Events) {
$Report += [PSCustomObject]@{
Check = 'Security Events'
Status = 'ALERT'
Details = ($Events | Select-Object TimeCreated, Id, Message | Out-String)
}
}
# Output report
$Report | Format-Table -AutoSize
$Report | Export-Csv -Path 'AiTM_IOC_Hunt_Report.csv' -NoTypeInformation
Write-Host "[+] Hunt complete. Report saved to AiTM_IOC_Hunt_Report.csv" -ForegroundColor Green
Response Priorities
Immediate (0-4 hours)
- Block listed IP addresses (185.238.2.195, 192.159.99.172, 2400:8d60:2::1:841d:5dd) at all perimeter security controls including firewalls, email gateways, and web proxies
- Add SHA256 hash to EDR blocklists and scan historical telemetry for presence
- Revoke all active sessions for users showing authentication from listed IPs in Azure AD sign-in logs
- Enable Azure AD Identity Protection policies for risky sign-ins if not already active
24 Hours
- Force password resets and require re-registration of MFA methods for all potentially compromised accounts
- Review mailbox rules, forwarding settings, and delegated access for signs of BEC preparation
- Audit application consent grants for suspicious OAuth applications with mail access permissions
- Deploy the provided Sigma rules to SIEM and validate detection logic
1 Week
- Implement phishing-resistant MFA (FIDO2/WebAuthn) for privileged accounts and high-value targets
- Enable continuous access evaluation (CAE) in Azure AD to reduce token replay windows
- Deploy conditional access policies restricting token issuance to compliant devices
- Conduct tabletop exercise simulating AiTM phishing and token replay response procedures
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.