[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0CJmNgSuz7gGv-dwMYbB5wPxRB9kGi003RyfradOYwQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"d2157e79-c049-4002-a723-f7f1d1925ea1","session-token-hijacking-bypasses-mfa-at-79-organizations","e12fba3f-c0d7-40ee-b6fc-3fd4c135731a","Session Token Hijacking Bypasses MFA at 79 Organizations","Attackers compromised Microsoft 365 accounts across 79 organizations by stealing and replaying session tokens obtained through phishing, completely bypassing multi-factor authentication. This attack demonstrates that MFA alone is insufficient when session management controls are weak — once a valid token is stolen, the attacker is treated as already authenticated. The threat actor then entrenched themselves by registering rogue devices and new MFA methods, making detection and eviction significantly harder. This matters because it represents a fundamental shift: attackers no longer need credentials or to break MFA, they simply steal the proof of authentication that comes after it.","**Immediate actions:**\n- Enable Conditional Access policies in Microsoft 365 to enforce token binding, device compliance checks, and continuous access evaluation so stolen tokens cannot be replayed from untrusted devices.\n- Audit all tenant MFA registrations and registered devices immediately, removing any unrecognized entries and requiring re-registration through a verified identity workflow.\n\n**Long-term improvements:**\n- Deploy phishing-resistant MFA methods (FIDO2\u002Fpasskeys) organization-wide to eliminate device-code phishing and token-theft attack surfaces.\n- Implement a Zero Trust architecture requiring continuous verification of device health, user risk signals, and session context rather than trusting a token once issued.\n- Establish inbox rule monitoring and alert policies to detect attacker-created rules that hide or forward emails, a common persistence technique in this campaign.\n\n**Detection measures:**\n- Configure SIEM\u002FUEBA rules to alert on new MFA method registrations, new device enrollments, and inbox rule creation outside of normal business hours or from unusual locations.\n- Regularly review Microsoft 365 unified audit logs and sign-in logs for anomalous token usage patterns, such as tokens used from multiple geographic locations in short timeframes.",[12,13,14,15,16,17,18],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 6: Access Control Management","MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 6: Access Control Management":23,"CIS Control 17: Incident Response Management":24,"CIS Control 14: Security Awareness and Skills Training":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 explicitly requires member-state organizations to implement incident handling measures including access control and authentication policies; the failure to detect rogue MFA registrations and token replay over ten weeks represents a clear gap in the mandated security hygiene this article requires.","The initial compromise in this campaign relied entirely on phishing for device-code tokens via fake sign-in pages, which is precisely the technique T1566 documents — organizations with phishing simulation training and anti-phishing technical controls would have reduced susceptibility.","While not a software patch issue, this control's broader mandate to identify and remediate weaknesses in security posture applies — organizations should have identified the architectural weakness of replayable session tokens and remediated it through Conditional Access and token binding policies.","CIS Control 6 requires managing and regularly auditing user access privileges and authentication mechanisms; enforcing phishing-resistant MFA and reviewing rogue device\u002FMFA registrations would have directly prevented attacker persistence in this incident.","The attacker operated undetected for up to ten weeks across 79 organizations, indicating a failure in both detection and incident response; a mature IR process with defined playbooks for token-theft and rogue device registration would have significantly shortened dwell time.","Victims were socially engineered into entering device-code flows on fake pages; regular, targeted training on recognizing device-code phishing and token-harvesting lures would have reduced the likelihood of employees falling for this technique.","This control directly requires organizations to manage session tokens, enforce strong authentication, and ensure only authorized identities can access resources — controls that, if implemented with token binding and Conditional Access, would have invalidated stolen tokens before they could be replayed.","published","2026-10-23T16:21:49.032828+00:00","2026-10-23T16:21:49.013+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F23\u002Fmicrosoft-365-accounts-stolen-sessions\u002F","microsoft-365-accounts-compromised-at-79-organizations-no-passwords-needed-d00a5f","Microsoft 365 accounts compromised at 79 organizations, no passwords needed",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[49,53,57],{"slug":50,"name":51,"problem":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":54,"name":55,"problem":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":58,"name":59,"problem":60},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps."]