MFA enabled, mailbox compromised: session theft

Many firms have enabled two-factor authentication on Microsoft 365 and consider email security addressed. Session theft using the adversary-in-the-middle (AiTM) technique gets around it without breaking it: a reverse proxy, often built with off-the-shelf kits such as Evilginx, sits between the professional and the real sign-in page, relays the password and code, and keeps the session cookie that Entra ID issues after the second factor (for example ESTSAUTH). A stolen session can allow unauthorised access, depending on the controls applied to the tenant.

Why the firm’s MFA does not stop session theft

OTP codes, push notifications and SMS protect the moment of sign-in, not the session that results from it. The proxy sees the code at the same instant Microsoft does. Methods bound to the origin, namely FIDO2 and passkeys, do resist: the key signs the request only for the legitimate domain and does not respond on a counterfeit one.

For the owner of the firm, the point to verify is which accounts can authorise payments and which protections cover them. The following checks should be delegated to whoever administers Microsoft 365.

Checks for your IT specialist: the logs

• In the Entra ID sign-in logs: a successful sign-in with MFA satisfied followed, a few minutes later, by a sign-in with the same session identifier but a different IP address, ASN or country.
• In the unified audit log: New-InboxRule, Set-InboxRule or UpdateInboxRules operations, with rules that move messages containing “bank transfer”, “IBAN” or a client’s name to rarely visited folders (RSS Feeds, Archive).
• Registration of a new authentication method on the account, which the attacker uses to stay in even after the password has been changed.

With PowerShell, Get-InboxRule -Mailbox followed by the address lists the rules of each mailbox. Suspicious rules call for further investigation: on their own they do not prove payment fraud.

The measures to consider

For partners and administration staff, whoever authorises or communicates payments, phishing-resistant methods are needed, enforced through Conditional Access using “authentication strength”. The same Conditional Access can allow email only from compliant devices managed with Intune: the protection has to be verified against the applications, sessions and policies actually configured. It requires Entra ID P1 licences, included in Microsoft 365 Business Premium.

Whenever there is a suspicion, changing the password is not enough: the sessions must be revoked (Revoke-MgUserSignInSession), and any added rules and MFA methods removed. Even without advanced licences, the outbound spam policy with AutoForwardingMode set to Off blocks automatic forwarding to external domains. If the incident has already happened, the reconstruction depends on how much of the Microsoft 365 logs is still available; the broader picture of risks for professional firms and the incident response process start from here.