Token replay gave attackers Microsoft 365 access at 79 organizations
Huntress logged 497 successful sign-ins and over 200,000 failures from July 14 to September 22, 2026.
2
Stories per day · 30 days
1 RSS
Relatedmicrosoft-3653aitm2business-email-compromise2entra-id2aitm-phishing1device-code1device-code-phishing1entra1inbox-rules1mfa1
4 stories, newest first · one card per story
Stories tagged #token-replay
Microsoft 365 token-replay campaign hit 97 accounts at 79 organizations
Huntress logged 497 successful sign-ins and 48 rogue Entra devices between July 14 and September 22, 2026.
1
M365 token spray and replay campaign hits 79 organizations
Huntress saw 497 successful sign-ins and more than 200,000 failed attempts from July 14 to September 22, 2026.
3
Inside Knight Office, a New M365 AiTM Phishing Kit
Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.
2