Security researchers analyzed a Microsoft 365 phishing campaign utilizing adversary-in-the-middle relays to capture sessions and replay stolen tokens at scale, compromising dozens of corporate accounts and registering rogue Entra devices.

Cybersecurity firm Huntress announced that it detected this activity between July 14 and September 22, 2026. According to the data, the perpetrators managed to compromise a total of 97 accounts across 79 different organizations.

How attacks stole digital keys

Instead of trying to guess users' passwords, these attacks used fake login pages that were placed between the user and the real services.…