Token-replay campaign hits 97 Microsoft 365 accounts at 79 organizations
Huntress reports an adversary-in-the-middle campaign that captured Microsoft 365 sessions and replayed stolen tokens to access email at 79 organizations between July 14 and September 22, 2026.
