threat-intel
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Info
Summary
A Microsoft 365 campaign involving token replay attacks has compromised 97 accounts at 79 organizations. The campaign involved using AitM relays to steal credentials and MFA codes, followed by deploying rogue devices to overcome MFA challenges and conduct automated sign-in attempts. Organizations are advised to revoke sessions, reset passwords, audit Entra devices, and review MFA methods.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data