Microsoft 365 Token-Relay Attacks Exploit AitM to Compromise 97 Accounts Across 79 Organizations

Cybersecurity researchers identified a Microsoft 365 token-relay attack exploiting adversary-in-the-middle (AitM) techniques to compromise 97 accounts across 79 organizations. Huntress detected 497 successful sign-in events between July 14 and September 22, 2026, highlighting the vulnerability of session token authentication.

Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.

Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across

Read original article