Stolen session tokens used to hijack Microsoft 365 accounts at 79 organizations
Huntress researchers say an attacker replayed stolen Microsoft 365 sessions to break into email accounts at 79 organizations between July and September, bypassing MFA without passwords.