News Summary

• Researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle ( AitM ) relay.
• The attackers captured sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
• The approach has been codenamed token spraying, as it involves the attacker replaying many stolen tokens at scale across several organizations in a manner that's analogous to password spraying.
• The campaign was first observed from a Romanian IP address " 193.26.115[.]221," which, according to VirusTotal, is used by a remote access trojan called AsyncRAT.