Act
active
Microsoft 365 Token-Replay AitM Campaign Hits 79 Organizations
- Engineer — Plan: Active AitM campaign bypasses MFA via stolen session tokens — no patch exists, but hardening is actionable: enable Entra ID Token Protection in Conditional Access policies and audit sign-in logs for anomalous token-replay patterns since July 14, 2026.
- SOC/IR — Act: Huntress documented 497 confirmed M365 sign-in events across 79 orgs from July 14–September 22, 2026; sweep Entra ID and M365 unified audit logs for token reuse from mismatched IP geographies or device states consistent with AitM relay behavior.
- Leader — Act: M365 email accounts at 79 organizations were compromised via session-token hijacking — brief leadership now given M365’s ubiquity in your estate, confirm Entra ID token protection and phish-resistant MFA are enforced, and assess whether any internal accounts show anomalous sign-in activity.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.