Dark Web Informer :verified_paw: on Nostr: 🚨 Microsoft 365 token replay campaign compromises 97 accounts across 79 ...

🚨 Microsoft 365 token replay campaign compromises 97 accounts across 79 organizations

Huntress tracked more than 200,000 login attempts and 497 successful sign-ins during the campaign, which ran from July 14 to September 22.
⠀
Attackers used adversary-in-the-middle phishing pages to steal authenticated Microsoft sessions, allowing them to bypass MFA by replaying the captured tokens from their own systems.

After gaining access, the attackers registered at least 48 rogue Entra devices, replaced victims’ MFA methods and created hidden inbox rules to conceal messages involving payroll, direct deposits, banking and bonuses.
⠀
In 19 organizations, existing MFA methods were removed and replaced within three hours of the initial compromise.

Organizations should revoke affected sessions, reset passwords, audit Entra devices and MFA methods, review inbox rules and restrict device-code authentication through Conditional Access.

Source: https://www.huntress.com/blog/token-replay-spray