Payroll Pirate: M365 Session Token Replay via Non-Interactive OAuth2 to Microsoft Graph

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects non-interactive Microsoft Graph OAuth2 token requests originating from unmanaged, deviceless sessions that falsely claim MFA satisfaction. The detection focuses on specific user agents known to be associated with automated token replay attacks and looks for multiple unique token identifiers per user session, which is indicative of credential or token theft rather than standard service account or application activity.