M365 Token Spray and Replay Campaign Compromises Business Email Accounts

T1Covered by 1 source · first reported by Huntress at 22 Oct, 13:00 UTC

Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.