Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Summary
Cybersecurity researchers have identified a campaign targeting Microsoft 365 accounts using an adversary-in-the-middle (AitM) relay technique. This method allows attackers to capture sign-in sessions and replay stolen tokens to compromise email accounts at numerous organizations.
IFF Assessment
The discovery of a new attack vector that compromises legitimate user accounts represents bad news for defenders as it highlights a new method for attackers to gain unauthorized access.
Defender Context
This attack highlights the continued threat of phishing and credential harvesting, specifically focusing on sophisticated techniques like AitM relays to bypass multi-factor authentication. Defenders should remain vigilant about user education regarding suspicious sign-in requests and investigate potential AitM activity, especially if unusual authentication patterns are observed.