Microsoft 365 accounts compromised at 79 organizations, no passwords needed

T2Covered by 1 source · first reported by Help Net Security at 23 Oct, 11:45 UTC

An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. The researchers tracked the campaign between July 14 and September…

sciencesecurity

Sources

• T2Microsoft 365 accounts compromised at 79 organizations, no passwords neededHelp Net Security23 Oct, 11:45