M365 Token Spray and Replay Campaign Compromises Business Email Accounts
// summary
A 10-week Microsoft 365 campaign used token replay, AiTM relays, rogue Entra devices, MFA tampering, and hidden inbox rules to compromise business email accounts.
// from the source
Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.