Microsoft 365 Token-Replay Attacks Compromise Multiple Organizations

Researchers have uncovered a campaign leveraging adversary-in-the-middle (AitM) relay techniques to capture M365 sign-in sessions. The stolen tokens are replayed to bypass standard authentication and gain unauthorized access to email accounts across dozens of organizations, highlighting the critical need for phishing-resistant multi-factor authentication.