Security · Updated 26 Oct, 02:05 pm IST
Token-replay attacks hit Microsoft 365; 97 accounts compromised at 79 organisations
Why it matters for readers: It shows a clever attack method that captures the short-lived proof of login and reuses it to break into accounts.
- Researchers traced more than 200,000 failed login attempts in the campaign to the 193.26.115.0/24 IP range.1
- The attackers used an adversary-in-the-middle login page to capture credentials, MFA codes and the access token issued by Microsoft.1
- Captured 'proof of login' tokens were replayed from attacker devices within minutes to conduct automated sign-in attempts, a technique Huntress calls 'token spraying'.1
- Across victim organisations Huntress detected 497 successful Microsoft 365 sign-ins and ultimately confirmed 97 compromised accounts and 48 rogue Entra devices.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started