Microsoft 365 Token Replay Campaign: How “Token Spraying” Hijacked Accounts at 79 Organizations
Between mid-July and late September 2026, researchers uncovered a widespread campaign that exploited stolen Microsoft 365 sign-in tokens to break into email accounts across dozens of organizations. Instead of brute-forcing credentials, attackers captured session tokens via adversary-in-the-middle (AitM) relays and other means, then replayed those tokens from their own infrastructure to authenticate as victims. The technique allowed an efficient, MFA‑circumventing path into mailboxes and Microsoft directories — with persistence and…
