M365 Token Spray and Replay Campaign Compromises Business Email Accounts

Reported by Huntress

Summary by Cyber Security News22 Oct 2026, 15:00 CET

About this summary. This is a short excerpt from the description that Huntress published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.huntress.com/blog/token-replay-spray

Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.

Read the full article at Huntress →

Source attribution: headline and facts are from Huntress (huntress.com). Summary method: excerpt of the source description. See our source attribution policy.