Token replay gave attackers Microsoft 365 access at 79 organizations
Huntress logged 497 successful sign-ins and over 200,000 failures from July 14 to September 22, 2026.
74
Product
SharePoint Online
- Mentions · 7d1
- Mentions · 30d3
- All mentions5
- First seenAug 18, 2026
- Last mentioned4d ago
Timeline
5 articles · newest firstConnectWise Cloud Backup API secret used against Microsoft 365 tenants
Huntress saw malicious sign-ins across almost 1,000 Entra tenants, with more than 300 appearing to succeed.
78
ConnectWise suspends cloud services after M365 tenant access
Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.
78
Passkey-themed phishing attacks lead to Microsoft 365 data theft
Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.
78
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Ontinue disclosed TWINLOOT, a Python implant hiding C2 in SharePoint dead drops and Teams TURN relays, harvesting credentials and pivoting via reverse SOCKS5.
60
Appears with
- Microsoftvendor · 5
- Microsoft 365product · 4
- Microsoft Teamsproduct · 3
- Huntressorganization · 3
- Exchange Onlineproduct · 3
- ConnectWisevendor · 2
- Microsoft Graphproduct · 2
- TWINLOOTmalware · 1
- Google Threat Intelligenceorganization · 1
- Cloud Backupproduct · 1
- Salesforceproduct · 1
- Dropboxproduct · 1
- Microsoft Edgeproduct · 1
- Google Workspaceproduct · 1
- Storm-3032threat actor · 1
- ShinyHuntersthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.