Token Replay Turns Stolen Microsoft 365 Sessions Into 97 Account Compromises Across 79 Organizations

Researchers at Huntress have disclosed a Microsoft 365 intrusion campaign in which attackers used an adversary-in-the-middle (AitM) relay to intercept authentication traffic, capture legitimate sign-in sessions, and then replay the stolen tokens to access email accounts. The activity, observed between July 14 and September 22, 2026, resulted in 97 compromised accounts spread across 79 organizations, according to The Hacker News.

The case is a textbook illustration of why credential theft no longer ends at the password. When multifactor authentication is satisfied on an attacker-controlled proxy, the resulting session token becomes the real prize — and it can be used without ever knowing the victim's password or triggering another MFA prompt.

How the AitM relay works

Adversary-in-the-middle phishing flips the traditional credential-harvesting model on its head. Instead of cloning a login page and hoping the victim types a password into it, the attacker positions a reverse proxy between the user and the genuine Microsoft sign-in service. The victim interacts with the real service the entire time, so the page looks and behaves exactly as expected. The proxy simply sits in the middle, decrypting the traffic, capturing credentials and MFA responses, and — critically — recording the session cookies issued after a successful authentication.

Those cookies are the keys to the kingdom. Once in hand, the attacker can import them into a browser or script and replay them against Microsoft 365, inheriting the victim's authenticated session without any further challenge. From the identity provider's perspective, the request appears to come from a legitimately signed-in user.

Huntress reported detecting 497 successful Microsoft 365 sign-in events during the observation window, a volume that underscores how automated and repeatable the replay step has become once tokens are captured.

Why token theft is so difficult to detect

Session-token replay is attractive to attackers precisely because it sidesteps the controls most organizations rely on. Password resets do nothing. MFA prompts never fire. Conditional access policies keyed to device compliance or location may or may not catch a replayed session, depending on how tightly they are scoped. The result is a class of intrusion that can persist quietly inside mailboxes for weeks.

The email focus is significant. Business email compromise remains one of the most reliable paths to financial fraud, invoice manipulation, and downstream phishing against partners and customers. A compromised mailbox also gives an attacker a trusted, internal vantage point for reconnaissance — reading threads, mapping reporting lines, and identifying upcoming payments or deals.

Defensive priorities

Security teams cannot treat this as a phishing-awareness problem alone. The controls that matter most are the ones that reduce the value of a stolen token or shrink the window in which it can be used:

  • Shorten token lifetimes and enforce continuous access evaluation, so that revocation takes effect near-instantly rather than waiting for a token to expire.
  • Bind sessions to devices using conditional access and token protection features where licensing permits, making a token replayed from an unknown device far less useful.
  • Monitor for anomalous session behavior, including sign-ins from new IP addresses or user agents that reuse an existing session, impossible-travel patterns, and mailbox rule creation shortly after authentication.
  • Revoke sessions, not just reset passwords, when a compromise is suspected. Invalidating refresh tokens is essential; a password change alone leaves the attacker's session intact.
  • Hunt for AitM infrastructure in proxy and DNS logs, and block newly registered or lookalike domains that front authentication pages.

The bigger picture

AitM and token-replay techniques have moved from boutique phishing-kit features to mainstream criminal tooling, and the Microsoft 365 ecosystem is the primary target because of its ubiquity. The Huntress findings reinforce a shift in defensive thinking: identity is now the perimeter, and the session — not the password — is the asset that needs protecting.

Organizations should assume that some users will eventually land on a convincing proxy page. The goal is to ensure that when they do, the stolen session has a short shelf life, is tied to context that the attacker cannot easily replicate, and generates telemetry that defenders actually review.

For the full technical details and the researchers' observations, see the original reporting at The Hacker News.