M365 Token Spray and Replay Campaign Compromises Business Email Accounts

Huntress Version 1 original current

Imported from official source

Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.

This version

Version
1 of 1
Recorded
October 22, 2026 13:02
Change
Initial
Content hash
e83b6f8f4495a7fcc5fce8c53b80d152
All versions
Revision history

Officially records where a publication came from, not whether it is true. Imported records are reproduced from an organization's own official source.