Hackers Hijack Microsoft 365 Sessions by Bypassing MFA

Executive Summary

An active phishing campaign has been observed to target Microsoft 365 users by bypassing Multi-Factor Authentication (MFA) and stealing authenticated user sessions rather than just usernames and passwords. The campaign uses Adversary-in-the-Middle (AiTM) phishing techniques to intercept login requests, capture session cookies, and gain unauthorized access to Outlook and Microsoft 365 accounts.

Unlike traditional phishing attacks, victims may successfully complete MFA without realizing their authenticated session has already been compromised. Once attackers obtain a valid session cookie, they can access the victim's Microsoft 365 account without needing the password or a second authentication prompt.

This campaign highlights the growing shift in identity-based attacks, where threat actors are increasingly targeting authenticated sessions instead of credentials alone. Organizations using Microsoft 365 should strengthen identity security by combining phishing-resistant authentication, continuous monitoring, and rapid session revocation capabilities.

What Happened?

A sophisticated phishing campaign that abuses Adversary-in-the-Middle (AiTM) infrastructure to compromise Microsoft Outlook and Microsoft 365 accounts.

Rather than collecting credentials through fake login pages alone, the attackers position themselves between the victim and Microsoft's legitimate authentication service. This allows them to relay authentication requests in real time while capturing the session cookie issued after successful authentication.

Because the authentication process completes normally, victims often have no indication that their active session has been stolen.

The attackers have primarily targeted Microsoft 365 users, giving them access to cloud email services and other Microsoft applications associated with the compromised account.

How the Attack Works

The attack follows a relatively simple but highly effective process:

1. The victim receives a phishing email impersonating Microsoft or another trusted service.  

2. The email contains a link directing the victim to a convincing Microsoft 365 login page.  

3. The phishing site acts as a reverse proxy, forwarding authentication requests to Microsoft's legitimate login service.  

4. The victim enters their username and password and successfully completes MFA.  

5. Microsoft issues a valid authenticated session cookie.  

6. The phishing infrastructure intercepts and steals the session cookie before passing it to the victim.  

7. The attacker imports the stolen session into their own browser, immediately gaining access to the victim's Microsoft 365 account without triggering another MFA challenge.  

Because the attacker is using a legitimate authenticated session, many traditional security controls may view the activity as normal user behavior.

Why This Matters

Compromising a Microsoft 365 account provides attackers with much more than email access. Depending on the user's permissions, they may be able to:

• Read confidential emails and attachments.  

• Send phishing emails from a trusted corporate account.  

• Create malicious inbox rules to conceal activity.  

• Access files stored in OneDrive and SharePoint.  

• View Microsoft Teams conversations.  

• Harvest sensitive corporate information.  

• Launch Business Email Compromise (BEC) attacks.  

• Use the compromised account as a foothold for further attacks within the organization.  

Importantly, changing the user's password alone may not immediately remove the attacker's access if the stolen session remains active. Organizations should revoke all active sessions and invalidate authentication tokens as part of the response process.

Technical Analysis

The campaign leverages AiTM phishing infrastructure, which functions as a transparent reverse proxy between the victim and Microsoft's authentication platform.

Unlike credential harvesting attacks, the proxy forwards all traffic to the legitimate Microsoft login page while simultaneously capturing:

• User credentials  

• MFA responses  

• Authentication cookies  

• Session tokens  

Because the victim interacts with the legitimate Microsoft authentication flow, even advanced authentication methods such as push notifications or one-time passcodes can be successfully completed before the session is intercepted.

This technique significantly reduces the effectiveness of traditional MFA when used as the only identity protection mechanism.

Business Impact

For executive leadership, this campaign reinforces that identity has become one of the most valuable attack surfaces.

A single compromised Microsoft 365 account can result in:

• Business Email Compromise (BEC)  

• Financial fraud through email impersonation  

• Exposure of confidential customer or corporate information  

• Regulatory and compliance implications  

• Reputational damage  

• Disruption of business operations  

• Increased risk of lateral movement across cloud services  

Organizations should therefore treat identity compromise with the same level of urgency as a network intrusion.

Recommendations

• Review Microsoft Entra ID (Azure AD) sign-in logs for suspicious or impossible travel events.  

• Revoke all active sessions for users suspected of compromise.  

• Reset affected user passwords.  

• Review mailbox rules, forwarding rules, delegated mailbox permissions, and OAuth application consents.  

• Investigate unusual email activity, including messages sent from compromised accounts.  

• Monitor for unauthorized access to OneDrive, SharePoint, and Teams.

Conclusion

This campaign demonstrates that MFA is no longer a standalone defense against account compromise. Attackers are increasingly targeting authenticated sessions instead of passwords, enabling them to bypass traditional authentication controls without exploiting Microsoft vulnerabilities. Organizations should adopt a layered identity security strategy that combines phishing-resistant authentication, Conditional Access, continuous monitoring, and rapid incident response to effectively defend against session hijacking attacks.

‍