# m365

Published articles for m365.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## M365 Token Spray and Replay Campaign Compromises Business Email Accounts

DevFeed: [M365 Token Spray and Replay Campaign Compromises Business Email Accounts](<https://devfeed.tech/articles/m365-token-spray-and-replay-campaign-compromises-business-email-accounts-95713.md>)

Original publisher: [Read original article](<https://www.huntress.com/blog/token-replay-spray>)

Author: Andrea Hatcher; Susannah Matt; Matt Poto; Andrew Schwartz

Published: 2026-10-22T13:00:00Z

Content type: news

Language: en

Sources: [Huntress Blog](<https://devfeed.tech/sources/huntress-blog.md>)

Topics: [Adversary-in-the-middle (AiTM)](<https://devfeed.tech/topics/adversary-in-the-middle-aitm.md>), [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [microsoft 365](<https://devfeed.tech/topics/microsoft-365.md>)

Tags: [2](<https://devfeed.tech/tags/2.md>), [2025](<https://devfeed.tech/tags/2025.md>), [2026](<https://devfeed.tech/tags/2026.md>), [22](<https://devfeed.tech/tags/22.md>), [3](<https://devfeed.tech/tags/3.md>), [business](<https://devfeed.tech/tags/business.md>), [campaign](<https://devfeed.tech/tags/campaign.md>), [devices](<https://devfeed.tech/tags/devices.md>), [email](<https://devfeed.tech/tags/email.md>), [hidden](<https://devfeed.tech/tags/hidden.md>), [huntress](<https://devfeed.tech/tags/huntress.md>), [m365](<https://devfeed.tech/tags/m365.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [microsoft-365](<https://devfeed.tech/tags/microsoft-365.md>), [pairing](<https://devfeed.tech/tags/pairing.md>), [rogue](<https://devfeed.tech/tags/rogue.md>), [rules](<https://devfeed.tech/tags/rules.md>), [token](<https://devfeed.tech/tags/token.md>), [with](<https://devfeed.tech/tags/with.md>)

### AI overview

Huntress tracked a 10-week Microsoft 365 campaign in which attackers replayed tokens stolen through AiTM relays, device-code phishing, and social engineering, bypassing another MFA prompt. Activity included rogue Entra devices, MFA replacement, hidden inbox rules, and payroll-related email abuse. The relays and replay hosts used different providers, so blocking one side would not stop the other; rotating replay addresses also limited single-IP blocks, while blocking the observed /24 covered the six main replay hosts. Huntress recommends Conditional Access requiring MFA or blocking across users, cloud apps, and client app types, prioritizing credential validity over failed-attempt volume, and restricting device-code flow. For suspected compromise, revoke sessions and reset passwords, then audit Entra devices, MFA methods, inbox rules, sign-ins, and new enterprise applications; password reset alone may leave access tokens, rogue devices, or MFA methods in place.

### Source excerpt

Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.

## ConnectWise Suspends Cloud Services in Response to Cyberattack

DevFeed: [ConnectWise Suspends Cloud Services in Response to Cyberattack](<https://devfeed.tech/articles/connectwise-suspends-cloud-services-in-response-to-cyberattack-90048.md>)

Original publisher: [Read original article](<https://www.securityweek.com/connectwise-suspends-cloud-services-in-response-to-cyberattack/>)

Author: Ionut Arghire

Published: 2026-10-19T13:16:20Z

Content type: news

Language: en

Sources: [SecurityWeek](<https://devfeed.tech/sources/securityweek.md>)

Topics: [credential-based attacks](<https://devfeed.tech/topics/credential-based-attacks.md>), [Entra ID](<https://devfeed.tech/topics/entra-id.md>), [Endpoint security](<https://devfeed.tech/topics/endpoint-security.md>), [Use Cases for Every Cloud Service Model](<https://devfeed.tech/topics/use-cases-for-every-cloud-service-model.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [connectwise](<https://devfeed.tech/tags/connectwise.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [huntress](<https://devfeed.tech/tags/huntress.md>), [m365](<https://devfeed.tech/tags/m365.md>), [malware-threats](<https://devfeed.tech/tags/malware-threats.md>), [microsoft-365](<https://devfeed.tech/tags/microsoft-365.md>), [security](<https://devfeed.tech/tags/security.md>)

### AI overview

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after a compromised credential was used to access Microsoft 365 tenants. The article reports attacker sign-ins, application permission changes, affected service functions, and ongoing customer checks for unauthorized configuration changes or persistence. ConnectWise had not provided a restoration timeline.

### Source excerpt

The services remain unavailable as the company continues remediation and security validation. The post ConnectWise Suspends Cloud Services in Response to Cyberattack appeared first on SecurityWeek.

## ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

DevFeed: [ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks](<https://devfeed.tech/articles/connectwise-skykick-vendor-credentials-abused-in-m365-attacks-89346.md>)

Original publisher: [Read original article](<https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access>)

Author: Jonathan Semon

Published: 2026-10-16T23:00:00Z

Content type: news

Language: en

Sources: [Huntress Blog](<https://devfeed.tech/sources/huntress-blog.md>)

Topics: [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Secrets Management](<https://devfeed.tech/topics/secrets-management.md>), [microsoft 365](<https://devfeed.tech/topics/microsoft-365.md>), [Microsoft](<https://devfeed.tech/topics/microsoft.md>)

Tags: [access-tokens](<https://devfeed.tech/tags/access-tokens.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [audit](<https://devfeed.tech/tags/audit.md>), [audit-logs](<https://devfeed.tech/tags/audit-logs.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [azure](<https://devfeed.tech/tags/azure.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [connectwise](<https://devfeed.tech/tags/connectwise.md>), [m365](<https://devfeed.tech/tags/m365.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>)

### AI overview

Huntress reports that stolen ConnectWise Cloud Backup credentials were used to obtain Microsoft Graph tokens in customer Microsoft 365 tenants. It confirmed unauthorized sign-ins in 162 tenants as of October 16, while warning that the application's broad permissions could expose mail, files, Teams data, and directory information. The article describes investigation findings, detection guidance, and steps for disabling affected applications and reviewing roles and credentials.

### Source excerpt

ConnectWise (SkyKick) vendor credentials are being abused to access Microsoft 365 tenants. Disable the apps now and check your logs here.