M365 Token Spray and Replay Campaign Compromises Business Email Accounts

Huntress BlogOctober 22, 2026Threat Intel Cloud

MentionsMicrosoft Microsoft 365

Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.

Summary from Huntress Blog.

Read the full article at Huntress Blog

Explained

The technology and terms in this story. Learn more

DefenceMFA · Multi-factor authenticationRequiring a second proof besides a password, such as an app prompt, a code or a security key.

More in Threat Intel

Synthetic identities leave US lenders with $2.4 billion in fraud exposure

Help Net Security1h agoThreat Intel

Sponsored: Should your threat hunt become a detection?

Podcast19 minRisky Business News11h agoThreat Intel

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120

Security Affairs17h agoThreat IntelVulnerabilities

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

BleepingComputeryesterdayThreat IntelEndpointVulnerabilities

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

The Hacker NewsyesterdayThreat Intel