Turning on multi-factor authentication is still the single highest-value security change most businesses can make. But the account takeovers we investigate now usually happen at companies that had MFA enabled. The attacks moved.
The three techniques we see
1. Adversary-in-the-middle phishing
The user clicks a link and lands on a proxy that renders a pixel-perfect Microsoft login page. They type their password, they get a real MFA prompt, they approve it — because it's genuinely their login attempt, just relayed. The attacker captures the resulting session cookie and is now inside the account without ever needing the password or code again. Off-the-shelf kits do this; it requires no skill.
2. Push fatigue and social engineering
The attacker has the password and spams approval prompts at 11pm until someone taps Approve to make it stop. Or they call posing as IT and talk the user through it.
3. Token and session theft
Info-stealer malware lifts browser session cookies straight off the endpoint. MFA was already satisfied; the attacker inherits the session.
What actually stops these
- Phishing-resistant MFA. FIDO2 security keys, passkeys, or Windows Hello for Business are cryptographically bound to the real domain — an AiTM proxy simply can't relay them. Deploy these to admins and finance first, then everyone.
- Number matching and context in push prompts. Kills blind-approval fatigue. It's a setting, not a purchase.
- Retire SMS and voice codes wherever you can. SIM swapping is real and these are the weakest factor still in common use.
- Conditional access on device compliance. Require a managed, compliant device for access to email and files. A stolen cookie replayed from an unmanaged machine gets blocked.
- Shorter session lifetimes and continuous access evaluation so a stolen token expires fast and revocation takes effect in minutes, not hours.
- Alert on the aftermath, not just the login. The attacker's next moves are predictable: new inbox rules that hide replies, a forwarding rule, a new MFA method registered, an unusual mail-forwarding domain. Monitor for those specifically.
- Out-of-band verification for money. No payment or bank-detail change on email authority alone — a phone call to a known number, every time. This one control prevents most business email compromise losses.
If you think an account is compromised
- Revoke all sessions and refresh tokens — a password reset alone does not evict an active session.
- Reset the password and re-register MFA methods from scratch.
- Audit inbox rules, forwarding, delegates, and connected apps.
- Check the audit log for what was accessed or downloaded, and who was emailed from the account.
- Notify affected clients or partners if fraudulent mail went out. Silence here damages trust far more than the breach does.
The takeaway
Most of the fixes above are configuration changes inside licensing you already own. If you'd like us to review how your MFA and conditional access are configured — and where the gaps are — see how we approach security or get in touch.
