Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Cybersecurity researchers at Huntress identified a Microsoft 365 campaign exploiting adversary-in-the-middle (AitM) relay techniques to capture sign-in sessions and replay stolen authentication tokens. The campaign was observed between July 14 and September 22, 2026, resulting in 497 successful sign-in events. A total of 97 accounts across 79 organizations were compromised through this token hijacking method. The attack bypasses traditional authentication controls by intercepting and reusing valid session tokens rather than stealing credentials. This type of attack is particularly dangerous as it can circumvent multi-factor authentication protections. The campaign specifically targeted Microsoft 365 email accounts, suggesting a focus on business email compromise or data exfiltration.