Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

A Microsoft 365 token-replay campaign compromised 97 accounts at 79 organizations by using an adversary-in-the-middle relay to capture sign-in sessions and replay stolen tokens to break into email accounts. Security firm Huntress observed the activity between July 14 and September 22, 2026, and detected 497 successful Microsoft 365 sign-in events.