Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and replay stolen tokens.
This activity, observed by Huntress between July 14 and September 22, 2026, resulted in the compromise of 97 Microsoft 365 accounts across 79 organizations. The attacks successfully captured sign-in sessions to break into email accounts.
By the numbers
- compromised accounts
- 97
- compromised organizations
- 79
Sources and references
Original report
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 0022YABU
Cite this
APA
Interestana AI Editorial. (2026, October 26). Microsoft 365 Accounts Compromised by Token Replay Attacks. Interestana. https://interestana.com/articles/microsoft-365-token-replay-attacks-compromise-97-accounts-at-79-organizations-0022yabu
MLA
“Microsoft 365 Accounts Compromised by Token Replay Attacks.” Interestana, 26 Oct. 2026, interestana.com/articles/microsoft-365-token-replay-attacks-compromise-97-accounts-at-79-organizations-0022yabu.
Chicago
Interestana AI Editorial. “Microsoft 365 Accounts Compromised by Token Replay Attacks.” Interestana, October 26, 2026. https://interestana.com/articles/microsoft-365-token-replay-attacks-compromise-97-accounts-at-79-organizations-0022yabu.
BibTeX
@misc{interestana_0022yabu,
author = {{Interestana AI Editorial}},
title = {{Microsoft 365 Accounts Compromised by Token Replay Attacks}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/microsoft-365-token-replay-attacks-compromise-97-accounts-at-79-organizations-0022yabu},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html}
}Credit the source
Original reporting: The Hacker News, “Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations”, https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe