Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Cybersecurity researchers identified a Microsoft 365 campaign that used an adversary-in-the-middle (AitM) relay to capture sign-in sessions and replay stolen tokens to access email accounts. Huntress observed the activity from July 14 through September 22, 2026; 97 accounts were compromised and 48 rogue Entra devices were registered across 79 organizations.