Token Replay Campaign Breaches Microsoft 365 Accounts At 79 Organisations Arabian Post

(MENAFN- The Arabian Post) clearfix"> Cybercriminals penetrated Microsoft 365 accounts at 79 organisations during a coordinated campaign involving stolen authentication tokens, phishing and attempts to conceal fraudulent email activity, cybersecurity company Huntress has disclosed.

The investigation, published on October 22, identified at least 497 successful sign-ins and more than 200,000 failed login attempts between July 14 and September 22. Researchers said attackers reused legitimate sessions captured through deceptive authentication processes, enabling access even where victims had completed multifactor authentication.

Huntress linked the activity to infrastructure associated with 1337 Services GmbH, a legitimate hosting provider incorporated in Hamburg. The identification concerns servers used for the attacks and does not establish that the hosting company participated in the operation. The individuals directing the campaign have not been identified.

MENAFN24102026000152002308ID1111860323