Token-Replay Attacks Compromise 97 Microsoft 365 Accounts Across 79 Organisations

Cybersecurity researchers have uncovered a targeted campaign that exploited token-replay vulnerabilities to compromise 97 Microsoft 365 accounts across 79 different organisations. The activity, which took place between 14 July and 22 September 2026, highlights the growing sophistication of attackers seeking to bypass modern authentication controls.

The campaign utilised an adversary-in-the-middle (AitM) relay to intercept authentication sessions. By positioning themselves between the user and the legitimate Microsoft 365 login service, attackers were able to capture session tokens. These stolen tokens were then replayed to gain unauthorised access to email accounts, effectively circumventing multi-factor authentication (MFA).

Widespread Unauthorised Access

According to findings from the cybersecurity firm Huntress, the campaign resulted in at least 497 successful unauthorised sign-in events. The attackers specifically targeted session tokens, which are issued after a user has successfully authenticated. Because these tokens represent a “trusted” state, replaying them allows a threat actor to impersonate the victim without needing to provide a password or satisfy an MFA challenge.

This method of adversary-in-the-middle phishing has become a preferred tactic for cybercriminals targeting enterprise environments. Unlike traditional phishing, which steals credentials, AitM attacks steal the active session itself, making them significantly harder to detect through standard identity protection logs.

Technical Implications for Digital Identity

The incident underscores a critical shift in the threat landscape regarding digital identity. While MFA remains a vital defensive layer, it is not a silver bullet against session-theft techniques. Attackers are increasingly focusing on the post-authentication phase, where session cookies and tokens provide long-lived access to sensitive corporate data.

To defend against such attacks, security teams are encouraged to implement stricter session management policies. This includes reducing token lifetimes and enforcing continuous access evaluation (CAE), which can revoke sessions in real-time if a change in the user’s security posture is detected. Organisations should also monitor for sign-in events originating from known AitM proxy infrastructures or unusual IP addresses.

Microsoft has previously issued guidance on protecting against token theft, recommending the use of phishing-resistant MFA, such as FIDO2 security keys or Windows Hello for Business, which bind the authentication process to the specific device and are not susceptible to traditional AitM relay tactics.