Microsoft 365 Token-Replay Attack Hits 97 Accounts

Introduction

Cybersecurity researchers have disclosed a previously undetected Microsoft 365 campaign that leveraged an adversary-in-the-middle (AitM) relay technique to capture active sign-in sessions and replay stolen authentication tokens, ultimately compromising 97 accounts across 79 distinct organizations. The campaign was active between July 14 and September 22, 2026, and was identified by Huntress, a managed security platform provider. The scale and persistence of the attack underscores the growing sophistication of identity-based threats targeting cloud environments.

Anatomy of the Token-Replay Attack

The attack chain began with the deployment of an AitM relay, a method that positions the attacker between a victim and a legitimate authentication service. When a user initiated a sign-in to Microsoft 365, the attacker intercepted the authentication traffic, capturing the resulting security token without needing to steal the user’s password directly. These tokens, which represent proof of successful authentication, were then replayed by the attackers to gain unauthorized access to victim mailboxes and associated cloud resources. Because the tokens were valid and freshly issued, traditional credential-based detection mechanisms often failed to flag the activity as malicious.

Huntress reported a total of 497 successful Microsoft 365 sign-in events during the observation window, indicating that the attackers were able to reuse captured tokens multiple times, potentially across different sessions or services. This reuse pattern suggests that the attackers had established a pipeline for harvesting, storing, and redeploying tokens in near real-time.

Who Is at Risk

Organizations relying on Microsoft 365 for business email, collaboration, or cloud-based productivity tools are the primary targets of this campaign. The attackers appear to have focused on mid-sized to large enterprises, given the number of organizations affected. Sectors that handle sensitive communications, financial data, or intellectual property are especially vulnerable, as compromised email accounts can serve as entry points for further lateral movement or data exfiltration.

Notably, the use of AitM techniques means that even organizations enforcing multi-factor authentication (MFA) may not be fully protected. While MFA can prevent some forms of credential theft, it does not inherently prevent token replay attacks once a session has been authenticated.

What Defenders Should Do Now

To mitigate the risk of similar token-replay campaigns, security teams should take several immediate steps. First, enforce conditional access policies that restrict sign-ins based on device compliance, location, and risk signals. Second, implement continuous access evaluation (CAE), which allows for real-time revocation of tokens when suspicious activity is detected. Third, review and tighten session lifetime configurations to reduce the window of opportunity for token reuse.

Organizations should also enable advanced auditing in Microsoft 365 to monitor for anomalous sign-in patterns, such as tokens being used across geographies in short succession or from unfamiliar devices. Deploying user and entity behavior analytics (UEBA) can help surface these irregularities. Additionally, security awareness training should emphasize the risks of interacting with phishing links or untrusted login pages, as these are common delivery vectors for AitM attacks.

Conclusion

The Microsoft 365 token-replay campaign targeting 97 accounts across 79 organizations serves as a stark reminder that identity remains the new perimeter. As attackers refine their use of AitM relays and token harvesting, defenders must evolve beyond static authentication measures and embrace dynamic, risk-aware access strategies. For organizations seeking to strengthen their cloud security posture, integrating AI-driven threat detection and automated response workflows can help identify and neutralize session-based attacks before they escalate. At Grivyonx Technologies, our AI automation and DevSecOps solutions are designed to help enterprises build resilient, adaptive security architectures that keep pace with the evolving threat landscape.