Kiberxavfsizlik tadqiqotchilari Microsoft 365 kampaniyasini oshkor qildilar, unda dushman-o'rtasida (AitM) relay yordamida kirish sessiyalarini qo'lga kiritish va keyin o'g'irlangan tokenlarni qayta ishlatish orqali 79 tashkilotdagi elektron pochta hisoblariga kirish kuzatilgan.
Huntress, 2026-yil 14-iyuldan 22-sentabrgacha bo'lgan faoliyatni kuzatgan, jabrlanuvchi tashkilotlarda 200 000 dan ortiq kirish urinishlaridan 497 ta muvaffaqiyatli Microsoft 365 kirish hodisasini aniqlaganini aytdi. Hujumchilar oxir-oqibat 97 ta hisobni buzib, 48 ta soxta Entra qurilmasini ro'yxatdan o'tkazgan.
"Parollarni taxmin qilish o'rniga, hujumchi jabrlanuvchilardan o'g'irlangan kirish tokenlarini qayta ishlatdi va biz kampaniya oynasidan 193.26.115[.]0/24 IP diapazoniga qaytib kelgan 200 000 dan ortiq muvaffaqiyatsiz kirish urinishlarini kuzatdik," deb aytishdi Huntress tadqiqotchilari Andrea Hatcher, Susannah Matt, Matt Poto va Andrew Schwartz.
Hujum AitM kirish sahifasidan foydalanishi aniqlangan, u jabrlanuvchilar va haqiqiy Microsoft infratuzilmasi o'rtasida turib, kiritilgan ma'lumotlar va MFA kodlarini qo'lga kiritadi va ma'lumotni haqiqiy kirish sahifasiga uzatadi.
Maqsad — kirish jarayonidan so'ng Microsoft tomonidan berilgan kirish tokenini to'plash, shunda MFA ni ikkinchi marta chetlab o'tish shart emas. "Kirish isboti" tokeni keyin hujumchi tomonidan o'z qurilmalaridan bir necha daqiqa ichida qayta ishlatiladi va Microsoft 365 xizmatlariga qarshi avtomatlashtirilgan kirish urinishlarini amalga oshiradi.
Bu yondashuv token spraying deb nomlangan, chunki u hujumchining o'g'irlangan tokenlarni bir nechta tashkilotlar bo'ylab keng miqyosda qayta ishlatishini o'z ichiga oladi, bu parol spraying ga o'xshaydi.
Muvaffaqiyatli kirishdan so'ng, hujumchilar yangi kirishlar uchun MFA muammolarini hal qilish va o'g'irlangan sessiya tokeni muddati tugashi yoki jabrlanuvchi tomonidan bekor qilinishi holatlarida bardoshlikni ta'minlash uchun o'z autentifikator ilovasini qo'shishgan.
Kamida 19 ta tashkilotda, jabrlanuvchining mavjud MFA usullari o'chirilgan va birinchi kirishdan uch soat ichida yangi usul ro'yxatdan o'tkazilgan. 2026-yil 21-iyulda kuzatilgan bir holatda, tahdid ishtirokchilari sessiya o'g'irlanganidan 51 daqiqadan kamroq vaqt ichida "iPhone 13" nomli yangi autentifikator ilovasini faollashtirgan.
"Soxta qurilmalar ham xuddi shu maqsadga xizmat qilgan," deb aytishdi tadqiqotchilar. "Tahdid ishtirokchisi jabrlanuvchi tashkilotlarning Microsoft kataloglarida kamida 48 ta soxta kompyuterni ro'yxatdan o'tkazgan. Ro'yxatdan o'tgan qurilma hujumchiga o'g'irlangan sessiyadan ko'ra tokenlarni so'rashning bardoshliroq usulini berishi mumkin va u kimdir o'chirmaguncha katalogda qoladi."
Bundan tashqari, hujumchilar jabrlanuvchilarning pochta qutilarida ".," "sss," "ss," "iT," ",.," "........," "s," va "d" kabi nomlar bilan yashirin elektron pochta qoidalarini o'rnatishgan, ular ma'lum kalit so'zlar — ish haqi, depozit va bonus — bilan bog'liq kiruvchi xatlarni o'chirish yoki ularni RSS Feeds va Conversation History kabi noaniq papkalarga ko'chirish uchun ishlatilgan.
Bir buzilgan pochta qutisida, elektron pochta qoidasi barcha kiruvchi xabarlarni o'qilgan deb belgilagan va ularni o'chirgan. Keyin pochta qutisi yuzlab tashqi qabul qiluvchilarga chiquvchi spam yuborish uchun ishlatilgan, Microsoft Entra ID Protection hisobni yuqori xavf deb baholaguncha.
Huntress aytishicha, tokenlar turli manbalardan kelib chiqqan, jumladan soxta kirish sahifalari ortidagi AitM relaylar, qurilma-kod phishing va haqiqiy kirish jarayonida ijtimoiy muhandislik.
Kampaniya birinchi marta Ruminiya IP manzili "[193.26.115[.]221](https://www.virustotal.com/gui/ip-address/193.26.115.221/detection)" dan kuzatilgan, VirusTotal ma'lumotlariga ko'ra, bu AsyncRAT deb nomlangan masofaviy kirish troyaniga tegishli. IP manzil 1337 Services GmbH nomli Germaniya hosting provayderi bilan bog'liq.
GreyNoise ma'lumotlari hozirda hosting provayderiga mos keladigan 29 ta IP manzilni ro'yxatga olgan, ulardan 10 tasi zararli deb belgilangan va beshtasi shubhali deb belgilangan. E'tiborga molik jihati, bu tashkilot StarkRDP va [rdp[.]sh](https://rdp.sh/privacy) bilan bog'liq, bu to'lov qiluvchi mijozlarga virtual serverlarni ijaraga olish imkonini beradi.
StarkRDP va rdp[.]sh bilan bog'liq domenlar, shuningdek Nulled, Cracked va Sellix veb-saytlari, 2025-yil yanvarida Talent deb nomlangan xalqaro huquqni muhofaza qilish operatsiyasi doirasida yopilgan. Yozish paytida, ikkala platforma faol, birinchisi hozir [exy[.]sh](https://exy.sh/) deb qayta nomlangan.
"StarkRDP har doim qonun bilan ishlagan va bu ayblov jinoyatlariga aloqador emas, va huquqiy jarayon buni tasdiqlaydi," deb aytgan StarkRDP Telegram hisobi 30-yanvar sanali postida, mustaqil kiberxavfsizlik jurnalisti Brian Krebs ma'lumotlariga ko'ra.
"Faqat veb-sayt serveri va bizning domenimiz musodara qilingan. Afsuski, hech kim kim buni olganini va kim bilan gaplashishimiz mumkinligini ayta olmaydi. Shuning uchun biz tez orada, boshqa nom ostida, 'StarkRDP' bobini yopish uchun operatsiyani qayta boshlaymiz."
Token qayta ishlatish buzilishidan shubhalanadigan tashkilotlarga sessiyalarni bekor qilish va parolni qayta o'rnatish, Entra qurilmalarini tekshirish, MFA usullarini ko'rib chiqish, kutilmagan pochta qoidalari yoki yangi korporativ ilovalarni tekshirish va Shartli Kirish siyosatlari bilan qurilma-kod ish oqimini cheklash tavsiya etiladi.
"Shartli Kirish Siyosatlari (CAP) MFA to'ldira olmaydigan ba'zi xavfsizlik bo'shliqlarini to'ldirishga yordam berishi mumkin, agar ular to'g'ri joriy etilsa," deb aytishdi Huntress tadqiqotchilari. "CAP larni o'rnatadigan bizneslar barcha foydalanuvchilar, barcha bulut ilovalari va barcha mijoz ilova turlari uchun MFA ni talab qilishi (yoki bloklashi) kerak, shartsiz."
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
"Rather than guessing passwords, the attacker replayed sign-in tokens stolen from victims, and we've traced more than 200,000 failed login attempts from the campaign window back to the 193.26.115[.]0/24 IP range," Huntress researchers Andrea Hatcher, Susannah Matt, Matt Poto, and Andrew Schwartz said.
The attack has been found to employ an AitM login page, which sits between the victims and legitimate Microsoft infrastructure to capture the entered credentials and MFA codes and relay the information to the real login page.
The end goal is to collect the access token issued by Microsoft following the sign-in process so that it doesn't have to bypass MFA a second time. The "proof of login" token is subsequently replayed by the attacker from their own devices within minutes to conduct automated sign-in attempts against Microsoft 365 services.
The approach has been codenamed token spraying, as it involves the attacker replaying many stolen tokens at scale across several organizations in a manner that's analogous to password spraying.
Upon gaining successful access, the attackers moved to add their own authenticator app as a form of persistence to complete MFA challenges for new sign-ins and overcome scenarios where the stolen session token expires or gets revoked by the victim.
In no less than 19 organizations, the victim's existing MFA methods were removed and a new method registered within three hours of the first sign-in. In one case observed on July 21, 2026, the threat actors activated a new authenticator app named "iPhone 13" less than 51 minutes after the session was hijacked.
"Rogue devices served the same purpose," the researchers said. "The threat actor registered at least 48 fake computers in victim organizations' Microsoft directories. A registered device can give the attacker a more durable way to request tokens than the stolen session alone, and it stays in the directory until someone deletes it."
Furthermore, the attackers have also been spotted setting up hidden email rules in victims' inboxes with names such as ".," "sss," "ss," "iT," ",.," "........," "s," and "d" to delete incoming mail with certain keywords referencing payroll, deposit, and bonus, or move them to obscure folders like RSS Feeds and Conversation History.
In one compromised mailbox, the email rule marked all incoming messages as read and deleted them. The mailbox was then used to send outbound spam to hundreds of external recipients before Microsoft Entra ID Protection rated the account high risk.
Huntress said the tokens originate from multiple sources, including AitM relays behind fake sign-in pages, device-code phishing, and social engineering during a legitimate login process.
The campaign was first observed from a Romanian IP address "[193.26.115[.]221](https://www.virustotal.com/gui/ip-address/193.26.115.221/detection)," which, according to VirusTotal, is used by a remote access trojan called AsyncRAT. The IP address is associated with a German hosting provider named 1337 Services GmbH.
Data from GreyNoise currently lists 29 IP addresses matching the hosting provider, out of which 10 have been flagged as malicious and five are marked suspicious. Notably, the entity is linked to StarkRDP and [rdp[.]sh](https://rdp.sh/privacy), which allows paying customers to rent virtual servers.
The domains linked to both StarkRDP and rdp[.]sh were taken down, alongside websites for Nulled, Cracked, and Sellix, as part of an international law enforcement operation dubbed Talent in January 2025. As of writing, the two platforms are operational, with the former now rebranded as [exy[.]sh](https://exy.sh/).
"StarkRDP has always been operating by the law and is not involved in any of these alleged crimes, and the legal process will confirm this," the StarkRDP Telegram account said in a post dated January 30, according to independent cybersecurity journalist Brian Krebs.
"The only things that were seized is [sic] the website server and our domain. Unfortunately, no one can tell who took it and with whom we can talk about it. Therefore, we will restart operation soon, under a different name, to close the chapter [of] 'StarkRDP.'"
Organizations who suspect a token replay compromise are recommended to revoke sessions and reset the password, audit Entra devices, review MFA methods, check for unexpected inbox rules or new enterprise applications, and restrict device-code workflow with Conditional Access policies.
"Conditional Access Policies (CAP) can help fill some of the security gaps that MFA can't, as long as they're appropriately implemented," Huntress researchers said. "Businesses setting up CAPs should require MFA (or block) for All Users, All Cloud Apps, and All Client App types, unconditionally."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.