Microsoft 365 Accounts Hit by Token Replay Attacks Across 79 Orgs
Huntress detected token replay attacks on Microsoft 365 across 79 orgs from July 14 to Sept. 22, logging 497 breaches and 200,000+ failed tries. Attackers bypassed MFA via stolen tokens to register rogue devices.
Security firm Huntress revealed token replay attacks on Microsoft 365. Attackers used stolen tokens to bypass passwords and MFA, registering controlled devices in Entra ID, altering MFA settings, and adding mail rules. Huntress warned that resetting passwords alone cannot stop persistent access; organizations must revoke active user sessions, remove unauthorized devices and MFA methods, and audit suspicious inbox rules.
Key takeaways
- Huntress recorded at least 497 successful logins and 200,000+ failed attempts across 79 orgs, where stolen tokens bypassed MFA to register rogue devices.
- Researchers warned that password resets alone cannot stop attackers; teams must revoke active sessions and remove unauthorized devices and MFA methods.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.