M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.
- Vendor
- Microsoft
- Product
- Microsoft 365 / Office
- Exposure class
- Collaboration
Why it ranks 13 (Routine)
- Product class: collaboration
- Widely deployed vendor product (Microsoft)
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Huntress (huntress.com)