Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

AI Summary

Huntress researchers documented a Microsoft 365 adversary-in-the-middle (AitM) campaign active between July 14 and September 22, 2026, that captured sign-in session tokens and replayed them to compromise 97 accounts across 79 organizations, generating 497 successful unauthorized sign-in events. The attack bypasses MFA by stealing post-authentication tokens rather than credentials, targeting email accounts at scale.

Read full article → https://thehackernews.com/2026/10/microsoft-365-to…

Relevance score: 72.0/100

# More from October 26

1
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking The Hacker News
2
PHP2Shell security flaws now sucessfully exploited in the wild BleepingComputer
3
PHP2Shell Exploitation Moves From Probes to Working Shells SecurityWeek
4
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs The Hacker News
5
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages SecurityWeek
7
Industrial Vendors Check Products for PHP2Shell Vulnerabilities SecurityWeek
8
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento The Hacker News
9
Popular AI tool LiteLLM says unrevoked key allowed hackers to target users The Record
10
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts The Hacker News