This Attack Steals Microsoft 365 Sessions Past MFA

A new campaign is bypassing Microsoft 365 MFA by stealing and replaying login tokens, compromising email accounts at nearly 80 different organizations.

A widespread attack campaign is successfully bypassing multi-factor authentication (MFA) to compromise Microsoft 365 accounts, according to new research from cybersecurity firm Huntress. The report details how attackers compromised 97 accounts across 79 different organizations between mid-July and late September. The campaign relies on a sophisticated technique known as a token-replay attack, which allows adversaries to hijack a legitimate user's authenticated session. By stealing the session token issued after a successful login, attackers can gain full access to a user's email and other connected services without needing their password or access to their MFA device. The findings underscore a critical challenge for organizations that rely on MFA as their primary defense against account takeovers, revealing that determined attackers have found effective ways to circumvent it.

The mechanism behind this breach is an adversary-in-the-middle (AitM) attack. It begins with a classic phishing email that tricks a user into clicking a malicious link. Instead of a simple fake login page, this link directs the victim to a proxy server controlled by the attacker, which sits invisibly between the user and the real Microsoft 365 login portal. The user sees the familiar Microsoft login screen and enters their username, password, and MFA code as usual. The AitM server relays this information to Microsoft in real time, and Microsoft, seeing a valid login attempt, issues a session token. The attacker’s server intercepts this token before it reaches the user's browser. With this stolen token, the attacker can now directly access the victim's account from their own machine, as the token serves as proof of an authenticated session. From Microsoft's perspective, this subsequent access looks legitimate, making it difficult to detect.

This type of attack is not entirely new, but its increasing accessibility and scale represent a worrying trend. For years, AitM phishing was a complex technique reserved for highly skilled threat actors. However, the proliferation of ready-made phishing toolkits like evilginx2 has democratized these attacks, making them available to a much broader range of cybercriminals. This campaign highlights a fundamental shift in attacker strategy. As MFA adoption has become standard, simply stealing passwords is no longer enough. Attackers have adapted by moving their focus from stealing static credentials to stealing the dynamic session tokens that grant access after authentication. This evolution forces a change in defensive thinking, moving beyond just securing the login event to continuously validating the session itself and monitoring for anomalous activity post-authentication.

For IT and security teams, this incident serves as a stark reminder that MFA is not an infallible solution. While it remains a critical security control, it must be part of a layered defense strategy. A key mitigation is to implement and fine-tune Conditional Access Policies within Microsoft Entra ID (formerly Azure AD). These policies can be configured to enforce stricter controls, such as shortening session token lifetimes, requiring logins to originate from trusted IP addresses or compliant devices, and flagging or blocking sessions with impossible travel characteristics. Furthermore, this threat amplifies the importance of deploying phishing-resistant MFA methods, like FIDO2 security keys, which cryptographically bind the login to the user's physical device and are not vulnerable to this kind of interception. Ultimately, as attackers continue to target session tokens, organizations must move toward a security model that assumes a breach is possible and focuses on rapid detection and response.

This token-replay attack demonstrates that even robust multi-factor authentication is not foolproof against sophisticated adversary-in-the-middle techniques. For security and IT teams, it highlights a critical vulnerability in session management and the need for continuous monitoring beyond the initial login.

Compromised Microsoft 365 accounts create a significant business risk, exposing sensitive corporate data, communications, and intellectual property. This can lead to financial loss, regulatory fines, and severe reputational damage, disrupting operations and eroding customer trust.