highCyber Attacks
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Huntress reports adversary-in-the-middle campaign leveraging stolen sign-in tokens to breach email accounts
Cyber.TechVoid1 min read
Key Takeaways
- Huntress observed a Microsoft 365 AitM relay campaign between July 14 and September 22, 2026.
- 497 successful sign-in events were detected, resulting in 97 account compromises at 79 organizations.
- The attack leveraged adversary-in-the-middle (AitM) techniques to capture and replay sign-in tokens.
Related Security News
highCyber Attacks
Gheist Campaign Exploits Stolen GitHub Tokens to Exfiltrate Private Repository Secrets
Security researchers at Wiz report that a threat actor identified as Gheist is using stolen GitHub tokens to inject malicious workflows into target repositories. These workflows are designed to print sensitive secrets—such as API keys and tokens—into GitHub Actions logs. The attackers subsequently download the logs and delete the workflow runs, obscuring their activity. The campaign has been observed affecting private repositories and GitHub Enterprise environments. GitHub has acknowledged the activity and implemented safeguards that pause workflows attempting to output secrets to logs.
The Hacker News2 min read
