As cited
Copy frozen at (site build).
threat intel
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress identified a 10-week campaign targeting Microsoft 365 that combined adversary-in-the-middle (AiTM) relays with token replay attacks, rogue Azure Entra devices, multifactor authentication (MFA) tampering, and concealed inbox rules to compromise business email accounts.
Why it matters: Organizations using Microsoft 365 face direct risk from this active campaign technique; practitioners should review access logs for rogue devices, audit MFA configurations, and check for hidden inbox rules that could indicate account compromise.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress identified a 10-week campaign targeting Microsoft 365 that combined adversary-in-the-middle (AiTM) relays with token replay attacks, rogue Azure Entra devices, multifactor authentication (MFA) tampering, and concealed inbox rules to compromise business email accounts.
Why it matters: Organizations using Microsoft 365 face direct risk from this active campaign technique; practitioners should review access logs for rogue devices, audit MFA configurations, and check for hidden inbox rules that could indicate account compromise.
- Source published
- First seen by Cybersecurity Tracker