AiTM token replay: sign-in error 50199 followed by success

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•3

Detects instances where a user experiences an interrupted sign-in event (Azure AD error code 50199) followed closely by a successful sign-in from the same user account. This pattern is often indicative of Adversary-in-the-Middle (AiTM) phishing, where an attacker intercepts an authentication request, prompts the user, and replays the captured session material.