Awareness Lessons
4 days ago
Session Token Hijacking Bypasses MFA at 79 Organizations
Attackers compromised Microsoft 365 accounts across 79 organizations by stealing and replaying session tokens obtained through phishing, completely bypassing multi-factor authentication. This attack demonstrates that MFA alone is insufficient when session management controls are weak — once a valid token is stolen, the attacker is treated as already authenticated. The threat actor then entrenched themselves by registering rogue devices and new MFA methods, making detection and eviction significantly harder. This matters because it represents a fundamental shift: attackers no longer need credentials or to break MFA, they simply steal the proof of authentication that comes after it.
Tactical Insight
Immediate actions
- Enable Conditional Access policies in Microsoft 365 to enforce token binding, device compliance checks, and continuous access evaluation so stolen tokens cannot be replayed from untrusted devices.
- Audit all tenant MFA registrations and registered devices immediately, removing any unrecognized entries and requiring re-registration through a verified identity workflow.
Long-term improvements
- Deploy phishing-resistant MFA methods (FIDO2/passkeys) organization-wide to eliminate device-code phishing and token-theft attack surfaces.
- Implement a Zero Trust architecture requiring continuous verification of device health, user risk signals, and session context rather than trusting a token once issued.
- Establish inbox rule monitoring and alert policies to detect attacker-created rules that hide or forward emails, a common persistence technique in this campaign.
Detection measures
- Configure SIEM/UEBA rules to alert on new MFA method registrations, new device enrollments, and inbox rule creation outside of normal business hours or from unusual locations.
- Regularly review Microsoft 365 unified audit logs and sign-in logs for anomalous token usage patterns, such as tokens used from multiple geographic locations in short timeframes.