The digital security landscape has undergone a tectonic shift where traditional perimeter-based defenses no longer provide a sufficient shield against specialized identity-based incursions. By capturing a pre-authenticated browser session, attackers can replay a user’s identity from their own infrastructure while bypassing multi-factor authentication requirements. This specific methodology, known as Adversary-in-the-Middle or AiTM phishing, represents a sharp departure from old-school credential harvesting where a simple password was the ultimate prize. In the current 2026 security environment, the session token serves as the true keys to the kingdom, allowing unauthorized individuals to maintain persistent access without ever re-entering credentials. This evolution in cybercrime emphasizes a focus on the post-authentication phase of a login, effectively neutralizing the safety net that many organizations once believed was impenetrable. As Microsoft 365 environments remain the primary hubs for corporate data, these attacks have become increasingly surgical, targeting high-value personnel with techniques that render standard endpoint protection almost entirely irrelevant.
The Anatomy of Session Hijacking
Exploiting Trust: Sophisticated Email Tactics
The sophistication of modern phishing emails has reached a point where traditional indicators of fraud are frequently absent from the message body. Attackers now leverage highly personalized content, such as fake human resources notifications or urgent payroll updates, to compel users into clicking malicious links. To bypass automated email security filters, these campaigns often utilize reputable third-party delivery platforms like SendGrid. By routing their traffic through these established services, the phishing messages inherit the sender reputation of the platform, allowing them to pass SPF and DMARC checks that would otherwise flag suspicious mail. This use of legitimate infrastructure makes it nearly impossible for basic security protocols to distinguish a fraudulent message from a standard business communication. Consequently, the phishing email arrives in the user’s primary inbox with a high degree of perceived legitimacy, significantly increasing the likelihood that the recipient will engage with the included link and inadvertently start the hijacking process.
The tactical execution of the lure continues through the meticulous design of the landing page, which serves as the primary interface for the session theft. These pages are often perfect visual clones of the official Microsoft 365 login portal, including localized branding and corporate logos tailored to the victim’s specific organization. The goal is to minimize friction and prevent the user from questioning the authenticity of the site during the heat of a busy workday. Because the attacker is using a proxy setup, any information the user enters is sent directly to the real service in real-time. This includes not just the username and password, but also the interaction with the multi-factor authentication provider. Whether the user receives a text code or an authenticator app prompt, the proxy server relays this information instantly to the legitimate Microsoft servers. This real-time interaction ensures that the user completes the login process as they normally would, totally unaware that their identity is being mirrored and intercepted.
Bypassing MFThe Proxy Infrastructure
The core of the AiTM attack lies in the interception of the session cookie, which is the digital receipt issued by a service after a successful authentication event. In a standard workflow, this cookie resides in the user’s browser and tells the cloud service that the user is who they claim to be and has already satisfied all required security challenges. However, in an AiTM scenario, the proxy server captures this cookie the moment it is issued by the Microsoft backend. Once the attacker possesses this token, they no longer need the user’s password or the physical MFA device for subsequent access. They can simply inject this stolen cookie into their own browser and refresh the target page. The cloud service sees a valid, MFA-satisfied session and grants the attacker full access. This bypass is particularly dangerous because it occurs entirely outside the scope of traditional MFA logic. The challenge was technically completed by the user, but the resulting proof of identity was stolen and re-used.
After the session cookie has been replayed, the threat actor enjoys a level of access that is functionally equivalent to the legitimate user. This allows them to explore the entire Microsoft 365 ecosystem, including Outlook, OneDrive, and SharePoint, without triggering further security prompts or alerts. Because the session is already authenticated, the attacker can often change account settings or move laterally within the organization to find more sensitive data. Furthermore, many organizations have long session lifetimes for the sake of user convenience, meaning a single stolen token can remain valid for days or even weeks. During this time, the attacker can monitor communications, download proprietary documents, and identify key financial processes to exploit for monetary gain. The technical challenge for defenders is that this activity does not involve malware execution on the local machine; rather, it is a manipulation of the cloud-based identity trust model, making it invisible to many traditional antivirus and endpoint solutions.
Identifying and Mitigating the Breach
Forensic Discovery: Analyzing Cloud Telemetry
Detecting an AiTM breach requires a shift in focus from workstation files to cloud-based sign-in logs and advanced telemetry data. One of the most reliable indicators of such an attack is the “impossible travel” alert, which occurs when the same session ID is used to access the service from two different geographic locations in a timeframe that would be physically impossible to travel between. For instance, if a user logs in from New York and the same session is utilized from a server in a different country five minutes later, it strongly suggests a token replay attack. Additionally, security teams must monitor for logins originating from known VPN exit nodes or hosting providers that are commonly used by cybercriminals to mask their physical location. While attackers attempt to hide their origin, the discrepancy between the user’s typical login patterns and the session hijacking activity often leaves a traceable path in the Entra ID sign-in logs that can be identified through automated analysis.
Beyond geographic anomalies, the presence of an intruder is often signaled by the sudden creation of malicious inbox rules designed to hide their activities. Attackers frequently set up rules that automatically move incoming emails from the finance department or specific vendors to the archive folder or mark them as read instantly. This covert manipulation ensures that the legitimate owner of the mailbox remains unaware of ongoing fraudulent conversations or changes to banking details. By suppressing notifications, the intruders can communicate with other employees or external partners while posing as the victim. Defenders should therefore implement automated alerts for any new inbox rules that involve keywords like “payment,” “invoice,” or “bank.” These behavioral changes in the mailbox environment are often more telling than the login itself, providing the necessary evidence to initiate an incident response plan and revoke all active sessions to stop the unauthorized access before financial damage occurs.
Defeating Schemes: Phishing-Resistant MFA
To effectively mitigate the threat of AiTM attacks, organizations moved toward the implementation of phishing-resistant authentication standards such as FIDO2 security keys. Unlike traditional multi-factor methods that rely on one-time codes or push notifications—which can be easily proxied by an attacker—FIDO2 uses public-key cryptography to bind the authentication session to the specific origin of the website. This meant that if a user attempted to log into a proxy site, the hardware key recognized that the domain did not match the registered service and refused to provide the authentication credential. By removing the possibility of token interception, these hardware-backed methods provided a robust defense against even the most advanced session hijacking techniques. Furthermore, coupling these technical controls with strict out-of-band verification procedures for all financial transactions ensured that even if a mailbox was temporarily compromised, the ultimate goal of the fraud could be intercepted by human intervention before any funds were transferred.
