Microsoft 365 Token-Replay Campaign Compromises 97 Accounts at 79 Organizations

# Microsoft 365 Token-Replay Campaign Compromises 97 Accounts at 79 Organizations

https://gcdradar.vercel.app/incidents/microsoft-365-token-replay-campaign-compromises-97-accounts · AIR-2026-1527 · closed 2026-11-09

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed real-world intrusion and account takeovers across multiple organizations.
- Fix status: No fix needed
- First reported: 2026-10-26 (happened 2026-09-22)
- AI role: No AI role
- Products: Microsoft 365

## Summary

An adversary-in-the-middle campaign leveraged stolen session tokens to break into Microsoft 365 accounts across 79 organizations. Huntress observed hundreds of successful unauthorized sign-in events during the activity period.

## What to do

Enable phishing-resistant MFA such as FIDO2 security keys and monitor for anomalous token usage.

## Affected and fixed versions

- Affected: Microsoft 365

## Latest updates

- 2026-10-26: Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations (https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html)

## Sources

- 2026-10-26 The Hacker News: Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.