Microsoft 365 Token Replay Bypassed MFA at 79 Firms
Microsoft 365 Token Replay Bypassed MFA at 79 Firms In brief Attackers replayed stolen Microsoft 365 session tokens at 79 organizations, logging in 497 times without a password. How token spraying works, and what stops it. Between July 14 and September 22, 2026, Huntress recorded 497 successful Microsoft 365 sign-ins from replayed tokens, against more … Read more