[{"data":1,"prerenderedAt":365},["ShallowReactive",2],{"globals":3,"cookie-settings":230,"post-m365-token-spraying":263},{"id":4,"title":5,"description":6,"logo_light":7,"logo_dark":7,"address":7,"contact_email":8,"contact_phone":7,"header_menu":9,"footer_menu":10,"favicon":7,"public_url":11,"meta_title":12,"meta_description":13,"robots":14,"head_scripts":15,"body_scripts":16,"default_header":17,"default_footer":196,"social_links":7},1,"CredenShare","Secure credential sharing for modern teams. Encrypted in your browser, with time-limited, access-controlled links.",null,"hello@credenshare.io","fafb0437-6fc7-409e-bcce-a2519eacef43","96f782ae-6d59-4601-abd1-a4fca64cc4de","https://credenshare.io","CredenShare - Secure Credential Sharing","Share passwords, API keys and secrets securely with CredenShare. Encrypted in your browser, time-limited access, and detailed access logs.","# CredenShare Robots.txt\nUser-agent: *\nAllow: /\n\n# Sitemap\nSitemap: https://credenshare.io/sitemap.xml\n\n# Disallow admin paths\nDisallow: /api/\nDisallow: /admin/\nDisallow: /dev/\n\n# Allow main content\nAllow: /blog/\nAllow: /features/\nAllow: /pricing/\nAllow: /security/\nAllow: /docs/\n\n# Crawl-delay\nCrawl-delay: 1\n",[],[],{"id":18,"sort":7,"user_created":19,"date_created":20,"user_updated":19,"date_updated":21,"name":22,"logo":7,"show_cta":23,"cta_label":24,"cta_link":25,"cta_style":26,"sticky":23,"transparent":27,"navigation":28},"d16d4c9e-b3f8-4ea8-988b-eab863efb29c","e7d5f744-1dbd-47ad-9e01-63a9303d109e","2026-02-03T16:36:10.957Z","2026-08-17T22:46:13.371Z","Default Header",true,"Get Started","https://app.credenshare.io/register","primary",false,{"id":9,"sort":7,"user_created":19,"date_created":29,"user_updated":7,"date_updated":7,"title":30,"location":31,"items":32},"2026-02-03T16:36:40.078Z","Main Navigation","main-menu",[33,44,52,56,64,72,80,87,90,97,106,113,118,125,133,138,145,153,161,169,172,180,188],{"id":34,"sort":35,"user_created":19,"date_created":36,"user_updated":19,"date_updated":37,"label":38,"type":39,"url":40,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":42,"description":43,"badge":7},"157a8094-f17f-4348-bd73-774c0573b088",0,"2026-10-04T15:58:24.950Z","2026-10-23T23:13:13.022Z","Guides & Templates","custom","/resources","bf76488c-e318-48a2-8561-c32f76c61383","i-heroicons-document-text","Free practical guides and checklists",{"id":45,"sort":4,"user_created":19,"date_created":46,"user_updated":7,"date_updated":7,"label":47,"type":39,"url":48,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":50,"description":51,"badge":7},"1ee916dd-34a1-41fc-ad80-64681d2440ed","2026-02-11T11:19:14.086Z","Features","/features","0a887c3c-a748-4217-9e34-daf852801d4e","i-heroicons-sparkles","Everything CredenShare offers",{"id":49,"sort":4,"user_created":19,"date_created":53,"user_updated":7,"date_updated":7,"label":54,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:13.606Z","Product","dropdown",{"id":57,"sort":4,"user_created":19,"date_created":58,"user_updated":7,"date_updated":7,"label":59,"type":39,"url":60,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":62,"description":63,"badge":7},"fd3cae1e-592b-413d-91e5-b1258e0aff49","2026-02-11T11:19:16.508Z","Team Onboarding","/solutions/team-onboarding","daee37a1-a164-4b63-be67-1f91e4e9b497","i-heroicons-user-plus","Securely onboard new team members",{"id":65,"sort":4,"user_created":19,"date_created":66,"user_updated":7,"date_updated":7,"label":67,"type":39,"url":68,"parent":41,"post":7,"navigation":9,"target":69,"classes":7,"page":7,"icon":70,"description":71,"badge":7},"0bacbbcf-acfb-4054-94dd-b3388ed7f576","2026-10-23T23:13:21.028Z","Compare","/compare","_self","i-heroicons-scale","Password managers and sharing tools compared",{"id":73,"sort":74,"user_created":19,"date_created":75,"user_updated":7,"date_updated":7,"label":76,"type":39,"url":77,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":78,"description":79,"badge":7},"63e46db0-4bed-4f24-b7bd-a79e821f3d89",2,"2026-02-11T11:19:16.976Z","Third-Party Access","/solutions/third-party-access","i-heroicons-users","Safe contractor credentials",{"id":81,"sort":74,"user_created":19,"date_created":82,"user_updated":7,"date_updated":7,"label":83,"type":39,"url":84,"parent":41,"post":7,"navigation":9,"target":69,"classes":7,"page":7,"icon":85,"description":86,"badge":7},"704e9cab-d404-4b7a-b5c1-d8d66aa45862","2026-10-23T23:13:21.131Z","How-to Guides","/guides","i-heroicons-light-bulb","Share passwords and secrets safely",{"id":61,"sort":74,"user_created":19,"date_created":88,"user_updated":7,"date_updated":7,"label":89,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:16.058Z","Solutions",{"id":91,"sort":74,"user_created":19,"date_created":92,"user_updated":7,"date_updated":7,"label":93,"type":39,"url":94,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":95,"description":96,"badge":7},"6eb63ded-6ac9-4595-a55f-8795b193fe04","2026-02-11T11:19:14.648Z","How It Works","/how-it-works","i-heroicons-play-circle","See CredenShare in action",{"id":98,"sort":99,"user_created":19,"date_created":100,"user_updated":19,"date_updated":101,"label":102,"type":39,"url":103,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":104,"description":105,"badge":7},"8a9a4df2-3f19-4897-948a-a4d520b9389b",3,"2026-02-11T11:19:20.202Z","2026-10-23T23:13:13.401Z","Documentation","https://docs.credenshare.io","i-heroicons-book-open","Guides and API reference",{"id":107,"sort":99,"user_created":19,"date_created":108,"user_updated":7,"date_updated":7,"label":109,"type":39,"url":110,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":111,"description":112,"badge":7},"1cf2f869-1bb4-447a-b9d7-738b45995379","2026-02-11T11:19:17.466Z","Credential Collection","/solutions/secure-requests","i-heroicons-inbox-arrow-down","Request credentials securely",{"id":114,"sort":99,"user_created":19,"date_created":115,"user_updated":7,"date_updated":7,"label":116,"type":39,"url":117,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"790829b5-6e85-45a2-b729-01a224f1c816","2026-02-11T11:19:18.867Z","Pricing","/pricing",{"id":119,"sort":99,"user_created":19,"date_created":120,"user_updated":7,"date_updated":7,"label":121,"type":39,"url":122,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":123,"description":124,"badge":7},"5c9151ac-94e1-4d54-8032-768568b9ad02","2026-02-11T11:19:15.116Z","Security","/security","i-heroicons-shield-check","Our security architecture",{"id":126,"sort":127,"user_created":19,"date_created":128,"user_updated":7,"date_updated":7,"label":129,"type":39,"url":130,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":131,"description":132,"badge":7},"d7882f47-9f94-4860-93df-0025ff5ac8bc",4,"2026-02-11T11:19:15.577Z","Integrations","/integrations","i-heroicons-puzzle-piece","Slack, API, and more",{"id":134,"sort":127,"user_created":19,"date_created":135,"user_updated":7,"date_updated":7,"label":136,"type":39,"url":137,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"e696e64d-65e1-4b67-aef9-60db78b9f4cf","2026-02-11T11:19:19.313Z","Blog","/blog",{"id":139,"sort":127,"user_created":19,"date_created":140,"user_updated":7,"date_updated":7,"label":141,"type":39,"url":142,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":143,"description":144,"badge":7},"2ac2df39-fbae-45a2-b87a-313bebb4a87b","2026-02-11T11:19:17.957Z","Development Teams","/solutions/development-teams","i-heroicons-code-bracket-square","Secure credentials for dev workflows",{"id":146,"sort":127,"user_created":19,"date_created":147,"user_updated":19,"date_updated":148,"label":149,"type":39,"url":150,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":151,"description":152,"badge":7},"719ce073-d71f-4450-b45a-f08a05db21b2","2026-02-11T11:19:20.640Z","2026-10-23T23:13:13.301Z","About","/about","i-heroicons-information-circle","Our mission and team",{"id":154,"sort":155,"user_created":19,"date_created":156,"user_updated":7,"date_updated":7,"label":157,"type":39,"url":158,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":159,"description":160,"badge":7},"e18246ff-9a00-449a-88f8-09490a3cead2",5,"2026-08-24T23:17:28.605Z","Vendor Access","/solutions/vendor-access","i-heroicons-building-office-2","Share credentials with outside vendors",{"id":162,"sort":155,"user_created":19,"date_created":163,"user_updated":19,"date_updated":164,"label":165,"type":39,"url":166,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":167,"description":168,"badge":7},"567bc13d-4499-4dc5-a346-5eba54c1c500","2026-02-11T11:19:21.085Z","2026-10-23T23:13:13.212Z","Tools","/tools","i-heroicons-wrench-screwdriver","Free security & developer tools",{"id":41,"sort":155,"user_created":19,"date_created":170,"user_updated":7,"date_updated":7,"label":171,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:19.768Z","Resources",{"id":173,"sort":174,"user_created":19,"date_created":175,"user_updated":7,"date_updated":7,"label":176,"type":39,"url":177,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":178,"description":179,"badge":7},"99bda669-3c3a-4521-815b-a1eb22a4098e",6,"2026-08-24T23:17:28.791Z","AI Agents","/solutions/ai-agents","i-heroicons-cpu-chip","Give agents scoped, expiring credentials",{"id":181,"sort":174,"user_created":19,"date_created":182,"user_updated":19,"date_updated":183,"label":184,"type":39,"url":185,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":186,"description":187,"badge":7},"1f787a64-8e12-484d-ae97-b6349bc82e52","2026-02-11T11:19:21.524Z","2026-10-23T23:13:13.121Z","Pastebin","https://paste.credenshare.io","i-heroicons-clipboard-document","Secure encrypted pastebin",{"id":189,"sort":190,"user_created":19,"date_created":191,"user_updated":19,"date_updated":192,"label":193,"type":39,"url":194,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":159,"description":195,"badge":7},"1f06247b-4633-4341-a388-95ffa524a27a",7,"2026-02-11T11:19:18.416Z","2026-08-24T23:17:03.952Z","Enterprise","/enterprise","Compliance and audit-ready security",{"id":197,"sort":7,"user_created":19,"date_created":198,"user_updated":19,"date_updated":199,"name":200,"logo":7,"tagline":201,"show_social":23,"copyright_text":202,"show_newsletter":23,"newsletter_heading":203,"newsletter_description":204,"navigation_columns":205,"bottom_links":206},"355d9ac1-c909-4cda-9071-cd3abb00a0b5","2026-02-03T16:36:11.825Z","2026-11-02T14:01:12.933Z","Default Footer","Secure credential sharing for modern teams.","© {year} CredenShare Inc. All Rights Reserved.","Stay updated","Credential incidents explained and practical guides, every two weeks. Unsubscribe any time.",[],{"id":207,"sort":7,"user_created":19,"date_created":208,"user_updated":7,"date_updated":7,"title":209,"location":210,"items":211},"861b9a44-206d-4778-9251-f5269206fdf9","2026-02-03T16:36:41.786Z","Legal Links","legal-menu",[212,218,224],{"id":213,"sort":4,"user_created":19,"date_created":214,"user_updated":19,"date_updated":215,"label":216,"type":39,"url":217,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"3e16a067-ce9f-4e4d-aea6-7a602094f9df","2026-02-03T16:37:32.902Z","2026-08-25T00:24:57.325Z","Terms of Service","/legal/terms",{"id":219,"sort":74,"user_created":19,"date_created":220,"user_updated":19,"date_updated":221,"label":222,"type":39,"url":223,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"6e9bc58b-b6d0-46f8-8c7b-123ea3273f5b","2026-02-03T16:37:32.360Z","2026-08-25T00:24:57.850Z","Privacy Policy","/legal/privacy",{"id":225,"sort":99,"user_created":19,"date_created":226,"user_updated":19,"date_updated":227,"label":228,"type":39,"url":229,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"78a410a6-802d-4920-a915-d8e5d2155f0c","2026-02-03T16:37:33.462Z","2026-08-25T00:24:59.086Z","Cookie Policy","/legal/cookies",{"enabled":23,"banner_position":231,"banner_title":232,"banner_text":233,"accept_all_text":234,"decline_all_text":235,"preferences_text":236,"save_preferences_text":237,"policy_page":238,"privacy_page":240,"categories":242,"id":4},"bottom","We value your privacy","We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. By clicking \"Accept All\", you consent to our use of cookies.","Accept All","Decline All","Manage Preferences","Save Preferences",{"slug":239},"legal/cookies",{"slug":241},"legal/privacy",[243,248,253,258],{"id":244,"name":245,"key":246,"description":247,"required":23,"default_enabled":23},"1","Essential","essential","Required for the website to function. Cannot be disabled.",{"id":249,"name":250,"key":251,"description":252,"required":27,"default_enabled":27},"2","Analytics","analytics","Help us understand how visitors interact with our website.",{"id":254,"name":255,"key":256,"description":257,"required":27,"default_enabled":27},"3","Marketing","marketing","Used to deliver relevant advertisements and track campaign performance.",{"id":259,"name":260,"key":261,"description":262,"required":27,"default_enabled":27},"4","Preferences","preferences","Remember your settings and preferences for a better experience.",{"id":264,"status":265,"sort":7,"user_created":19,"date_created":266,"user_updated":19,"date_updated":267,"date_published":267,"user_published":19,"date_scheduled_publish":267,"title":268,"slug":269,"seo":270,"excerpt":278,"tags":279,"categories":292,"blocks":298,"featured_image":345,"author":359},"dffde6dd-50e3-4e12-8684-5bca9d5a8db7","published","2026-10-28T12:51:11.533Z","2026-11-02T14:01:12.157Z","Token spraying: how stolen Microsoft 365 sessions walked past MFA at 79 organisations","m365-token-spraying",{"title":271,"meta_description":272,"no_index":27,"no_follow":27,"og_title":273,"og_description":273,"og_image":7,"sitemap_change_frequency":274,"sitemap_priority":275,"additional_fields":276},"Token spraying: stolen M365 sessions bypassed MFA","Huntress traced 97 Microsoft 365 accounts taken over by replaying stolen sign-in tokens. How token spraying works, why resets failed, and what to check.","","monthly",0.6,{"canonical_url":277},"https://credenshare.io/blog/m365-token-spraying","Attackers took over Microsoft 365 mailboxes at 79 organisations without guessing a password or defeating MFA, by replaying stolen sign-in tokens. How it worked, why a password reset was not enough, and what to check.",[280,287],{"tags_id":281},{"id":282,"status":283,"user_created":19,"date_created":284,"user_updated":7,"date_updated":7,"slug":285,"name":286},"26cdb14a-ced0-4366-b112-7370c97f4026","draft","2026-02-09T19:40:46.566Z","credentials","Credentials",{"tags_id":288},{"id":289,"status":283,"user_created":19,"date_created":290,"user_updated":7,"date_updated":7,"slug":291,"name":121},"c3b30a85-9580-418c-953e-cf29032755a0","2026-02-09T19:40:48.946Z","security",[293],{"categories_id":294},{"id":295,"status":283,"sort":7,"user_created":19,"date_created":296,"user_updated":7,"date_updated":7,"parent":7,"name":121,"description":297,"image":7,"slug":291},"53da492a-49b5-4508-92b5-fe173c23891d","2026-02-09T19:40:43.953Z","Deep dives into encryption, data protection, and credential security.",[299,306,319],{"id":300,"collection":301,"item":302},64,"block_markdown",{"id":303,"sort":7,"user_created":19,"date_created":304,"user_updated":7,"date_updated":7,"content":305},"52614c20-19e7-4a2a-a4ca-8cde137219f2","2026-10-28T12:51:11.539Z","*Based on Huntress's report of October 22, 2026. Figures are Huntress's own.*\n\nFor ten weeks this summer, someone broke into Microsoft 365 mailboxes at 79 organisations without ever guessing a password or defeating a single MFA prompt. Huntress, which detected the campaign between July 14 and September 22, counted 497 successful sign-ins and more than 200,000 failed attempts traced to one block of rented IP addresses, ending in 97 compromised accounts and 48 fake computers registered in victims' directories. The researchers call the technique token spraying: the same pattern as password spraying, but with stolen sign-in tokens instead of guessed passwords.\n\nIt deserves attention from anyone who runs Microsoft 365 for a small or mid-sized business, because the victims in Huntress's examples had done what we usually tell people to do. They had MFA, and they completed it themselves. It didn't matter.\n\n## How do you get past MFA without breaking it?\n\nYou let the victim pass it for you. In an adversary-in-the-middle attack, the victim signs in through a relay that sits between them and Microsoft. The relay shows them the real sign-in page and the real MFA prompt, the victim completes both, and Microsoft issues the token that proves the sign-in succeeded. The relay keeps a copy. Because that token is minted after MFA, whoever holds it does not need to pass MFA again.\n\nHuntress describes the operation in two tiers. Relays behind fake sign-in pages captured sessions. Within minutes, a separate set of rented hosts replayed them: in one July case the gap between the victim reaching the MFA prompt and the hijacked session appearing elsewhere was twelve minutes, and by September it was four. Tokens also came from device-code phishing, where the victim is talked into typing a code on Microsoft's genuine sign-in page and, without realising it, authorises the attacker's session. Because capture and replay ran on different providers, blocking one half did nothing about the other.\n\n## Why didn't a password reset fix it?\n\nBecause the attacker didn't stay on the stolen token for long. A session token eventually expires or gets revoked, so the first thing the operator did in many accounts was make the access durable. In 19 organisations, Huntress saw the victim's existing MFA methods wiped and a new authenticator registered within three hours of the first sign-in from a campaign address. With their own authenticator on the account, the attacker can approve new sign-ins whenever they like, and that survives a password reset unless someone audits the account's MFA methods. The 48 rogue devices served the same purpose, as a more lasting way to request tokens.\n\nThere is a subtler point in the report as well. A password reset ends the refresh token and session cookie, but an access token already issued stays valid until it expires, which Huntress puts at roughly 90 minutes, unless sessions are explicitly revoked. Reset without revoke, and the attacker keeps working for the rest of that window.\n\n## What were they after?\n\nEmail. Huntress found hidden inbox rules with deliberately forgettable names, a single dot or a few letters, that marked mail as read and moved it to folders nobody opens, such as RSS Feeds or Conversation History. Some rules targeted messages mentioning payroll, direct deposit, bank or bonus. In one case the attacker used a compromised mailbox to send a payroll-related email to an outside accountant, then set a rule to hide the accountant's replies from the real owner. That is the familiar shape of business email compromise, reached here without a single password.\n\n## What actually stopped it?\n\nConditional Access, where it was configured properly. One replay address logged 1,052 blocked sign-ins, and every one of them came from just four organisations; in the 29 where it got in, nothing stood in the way. Huntress draws a practical lesson from that: don't prioritise response by how much spraying a tenant sees, because the noisiest tenants were the ones already protected. A Conditional Access block also happens after authentication succeeds, so it is evidence of a valid credential, not proof that nothing happened.\n\nHuntress's guidance for anyone who suspects a token replay compromise is specific, and worth following in order:\n\n1. **Revoke sessions and reset the password**, together. A reset alone leaves a working access token, and neither step removes devices or MFA methods the attacker added.\n2. **Audit MFA methods and Entra devices.** Remove authenticators the user doesn't recognise and look for devices registered from hosting providers, including names like `DESKTOP-` followed by eight hexadecimal characters.\n3. **Review inbox rules**, especially ones with one-to-three-character or punctuation-only names, rules that move mail to RSS or Conversation History folders, and rules keyed on payroll or banking terms.\n4. **Restrict the device-code flow** with Conditional Access authentication-flow policies, and require MFA, or block, for all users, all cloud apps and all client app types.\n\n## What should smaller teams take from this?\n\nThat MFA is a floor, not a finish line. Phishing-resistant sign-in methods, Conditional Access policies that cover every app and client type, and a habit of checking MFA methods and inbox rules after any suspicious sign-in all matter more than they did a year ago.\n\nIt is also a reminder of what to do with the new credential once an account has been recovered. The first thing many helpdesks do after a reset is send the user a temporary password, and the quickest channel is usually the same chat or email the attacker may have been reading. Send it in a link that expires after one view instead, with the passcode by phone or text, and make the user change it at first sign-in. Our guide to [sending a password securely](/guides/send-a-password-securely) walks through it step by step.\n\n---\n\n**Sources** (checked on October 28, 2026):\n[Huntress: M365 token spray and replay campaign compromises business email accounts (October 22, 2026)](https://www.huntress.com/blog/token-replay-spray)\n\n*Product names are trademarks of their respective owners. CredenShare is not affiliated with them.*",{"id":307,"collection":308,"item":309},65,"block_newsletter",{"id":310,"sort":7,"user_created":19,"date_created":311,"user_updated":7,"date_updated":7,"headline":312,"description":313,"placeholder_text":314,"button_text":315,"button_style":26,"form_action":7,"success_message":316,"error_message":317,"layout":318,"show_name_field":7,"background_color":7,"text_color":7,"style":7},"24aff482-67bc-4062-b2ad-ca42a63ff2bc","2026-10-28T12:51:11.564Z","Get the next one in your inbox","Every two weeks: one credential incident explained, three things worth knowing, and the practical steps from our latest guides. Unsubscribe any time.","Your work email","Subscribe","Almost there: check your inbox for a confirmation link.","Something went wrong. Please try again.","card",{"id":320,"collection":321,"item":322},66,"block_cta",{"id":323,"sort":7,"user_created":19,"date_created":324,"user_updated":7,"date_updated":7,"headline":325,"description":326,"alignment":327,"layout":328,"background_type":329,"background_color":7,"background_image":7,"gradient_start":330,"gradient_end":331,"gradient_direction":332,"text_color":7,"style":7,"buttons":333},"16e7a691-6748-4a5a-907b-a21af997ca7e","2026-10-28T12:51:11.586Z","Recovered an account? Send the temporary password in a link that expires","Free plan: 3 shares a day, encrypted in your browser.","center","stacked","gradient","#4c1d95","#7c3aed","to-right",[334,340],{"id":335,"sort":4,"user_created":19,"date_created":336,"user_updated":7,"date_updated":7,"cta_id":323,"label":337,"url":338,"variant":339,"size":7,"icon":7,"open_new_tab":7},"75a40ff5-e273-43eb-a118-daf072c9394c","2026-10-28T12:51:11.595Z","Get started free","https://app.credenshare.io/register?utm_source=credenshare.io&utm_medium=blog&utm_campaign=m365-token-spraying","solid",{"id":341,"sort":74,"user_created":19,"date_created":342,"user_updated":7,"date_updated":7,"cta_id":323,"label":343,"url":84,"variant":344,"size":7,"icon":7,"open_new_tab":7},"69f4a6e5-fcbf-42b8-9722-079b751b0073","2026-10-28T12:51:11.604Z","Read the guides","outline",{"id":346,"storage":347,"filename_disk":348,"filename_download":349,"title":350,"type":351,"folder":7,"uploaded_by":19,"created_on":352,"modified_by":7,"modified_on":353,"charset":7,"filesize":354,"width":355,"height":356,"duration":7,"embed":7,"description":7,"location":7,"tags":7,"metadata":357,"focal_point_x":7,"focal_point_y":7,"tus_id":7,"tus_data":7,"uploaded_on":358},"07f2121c-1dbd-4bbe-92ae-83653a6d367d","s3","07f2121c-1dbd-4bbe-92ae-83653a6d367d.png","blog-m365-token-spraying.png","Token spraying: how stolen Microsoft 365 sessions walked past MFA at 79 organisations (illustration)","image/png","2026-10-28T12:51:11.205Z","2026-10-28T12:51:11.441Z","431738",1600,900,{},"2026-10-28T12:51:11.439Z",{"id":360,"status":265,"sort":7,"user_created":19,"date_created":361,"user_updated":19,"date_updated":362,"name":5,"bio":363,"slug":364,"social_links":7,"seo":7,"avatar":7},"5fd13617-6298-4746-90f0-1c5c09ae18a3","2026-02-09T19:40:40.523Z","2026-02-09T19:43:37.635Z","The CredenShare team writes about secure credential sharing, password management, and enterprise security best practices.","credenshare",1794237320357]