Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Researchers reported a Microsoft 365 campaign that used an adversary-in-the-middle relay to capture and replay sign-in tokens, compromising accounts at 79 organizations.

• The campaign targeted Microsoft 365 email accounts using captured sign-in sessions and replayed tokens.· 1 source
• The reported method involved an adversary-in-the-middle relay to capture sessions.· 1 source
• The report says accounts at 79 organizations were affected.· 1 source