Technology
Stolen sessions, not passwords, opened 79 Microsoft 365 tenants
Huntress traced a ten-week campaign that replayed Microsoft 365 sign-in tokens harvested by adversary-in-the-middle login pages and device-code phishing, producing 497 successful sign-ins from more than 200,000 attempts across 79 organisations. Because the tokens were minted after multi-factor checks, passwords were never needed. Attackers added hidden inbox rules, registered rogue devices and swapped authenticators to stay in place. Revoke sessions, not just passwords, the researchers advise.