Microsoft 365 Token-Replay Attacks Hit 79 Organizations
Researchers uncovered a token-replay campaign exploiting adversary-in-the-middle relays to hijack Microsoft 365 session tokens across 79 organizations.
Why it matters
The campaign demonstrates an increasing risk of token-based session hijacking within enterprise Microsoft 365 environments, potentially undermining authentication controls and session integrity.
SOC impact
Defenders need to monitor authentication logs for unusual session activities indicative of token replay and verify the presence of affected accounts or systems involved in the July-September 2026 attacks. Correlating telemetry for abnormal sign-ins can help identify ongoing exploitation using similar techniques.
Recommended actions
- Monitor Microsoft 365 authentication logs for suspicious sign-in patterns involving session token reuse.
- Identify accounts or systems exhibiting unusual session activity within the July to September 2026 timeframe.
- Review deployment of adversary-in-the-middle protections and related network telemetry for signs of token interception.
- Correlate threat intelligence on token-replay techniques with internal event data to detect potential compromises.
Executive Summary
A recently uncovered token-replay campaign targeted Microsoft 365 accounts at 79 organizations, leveraging adversary-in-the-middle relays to capture and reuse session tokens. Huntress reported nearly 500 successful sign-ins using this method between July and September 2026. This highlights an evolving threat against session security in enterprise environments that rely on Microsoft 365 services.
Operationally, this attack underscores the importance of scrutinizing session authentication activities for unusual patterns consistent with token replay. Incident responders and security operations teams must prioritize validating authentication telemetry related to session reuse and potential interception to detect and respond to similar threats. Maintaining visibility into Microsoft 365 sign-ins and network indicators of adversary-in-the-middle techniques is critical to mitigating the risk posed by this attack vector.
SOC Impact
Defenders need to monitor authentication logs for unusual session activities indicative of token replay and verify the presence of affected accounts or systems involved in the July-September 2026 attacks. Correlating telemetry for abnormal sign-ins can help identify ongoing exploitation using similar techniques.
Authentication and Session Validation
- Monitor Microsoft 365 authentication logs for suspicious sign-in patterns involving session token reuse.
- Identify accounts or systems exhibiting unusual session activity within the July to September 2026 timeframe.
- Review deployment of adversary-in-the-middle protections and related network telemetry for signs of token interception.
- Correlate threat intelligence on token-replay techniques with internal event data to detect potential compromises.
Why It Matters
The campaign demonstrates an increasing risk of token-based session hijacking within enterprise Microsoft 365 environments, potentially undermining authentication controls and session integrity.