Threat Pulse 62High
Microsoft 365 token replay hits 97 accounts at 79 organizations
Severity 6ActiveconfirmedCloud and SaaSCredentials and personal data

Huntress tracked attackers replaying stolen sign-in tokens: over 200,000 attempts, 497 successful sign-ins, 97 accounts at 79 organizations, 48 rogue Entra devices registered and MFA settings changed. The campaign ran from July 14 to September 22.

· 10 days ago · thehackernews.com
Sourcesthehackernews.comHelp Net Security
On X
@TheHackersNewsverifiedOct 26, 08:38 UTC

97 Microsoft 365 accounts compromised across 79 organizations. Attackers replayed stolen sign-in tokens, registered 48 rogue Entra devices, and tampered with MFA settings to maintain access.

Open on X
Why this score

Plan rubric with caps (verified sweep, Oct 26)

Back to the board

Updated Nov 5, 01:47 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.