Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html
Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Veeam security advisory (AV26-1096)
Serial number: AV26-1096 Date: October 28, 2026 As of October 27, 2026, Veeam is affected by vulnerabilities in the following products: Veeam Agent for Linux Prior to…
CISA updates ScubaGear and ScubaGoggles, and says Microsoft 365 checks get faster
CISA released ScubaGear v2.0 and ScubaGoggles v1.1.0, new versions of the open-source tools it publishes to check Microsoft 365 and Google Workspace settings against its…
The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses…
🏴☠️ Auditteam has just published a new victim : Safe Data Storage
Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers…
Microsoft 365 accounts compromised at 79 organizations, no passwords needed
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims…
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen…