thehackernews.com
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Researchers at Huntress uncovered a Microsoft 365 token‑replay campaign that hijacked sign‑in sessions and replayed stolen access tokens to infiltrate 97 accounts across 79 organizations between July 14 and September 22, 2026. The attackers used an adversary‑in‑the‑middle login page to capture credentials and MFA codes, then harvested the resulting tokens and “sprayed” them at scale, achieving 497 successful sign‑ins from over 200,000 attempts traced to the 193.26.115.0/24 subnet. After gaining access, they added rogue authenticator apps and registered 48 fake Entra [...]