Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Cybersecurity researchers have identified a campaign targeting Microsoft 365 that uses an adversary-in-the-middle relay to capture and replay stolen sign-in tokens, compromising email accounts. The attack has affected 79 organizations, with 97 accounts breached. The campaign was observed between July 14 and September 22, 2026, during which 497 successful Microsoft 365 sign-in events were detected. The attacks involved capturing sign-in sessions and replaying the stolen tokens to gain unauthorized access. The compromised accounts were found across multiple organizations, indicating a widespread campaign.