Attackers recently broke through Microsoft 365’s multi-factor authentication (MFA) protections without malware, hijacking a finance employee’s account to reroute vendor payments. A single phishing email triggered a complex campaign that exploited browser session tokens and mailbox access to make the fraud look like ordinary business activity. This incident highlights how identity-focused attacks are evolving beyond simple password theft. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-bypass-microsoft-365-mfa/))
Phishing + Adversary-in-the-Middle Relay Steal Sessions
The compromise started with an email titled “PTO Request Denied,” tailored for a finance team member. It referenced their company, role, and name to appear legitimate. That email included a button going through a SendGrid tracking link and several attacker-run redirects, ultimately leading to a fake Microsoft 365 login page acting as an adversary-in-the-middle (AiTM) relay. When the target entered credentials and approved MFA, the attackers passed that info on to Microsoft in real time, stole the generated session cookie, and used it via VPN infrastructure to impersonate the already authenticated user—without triggering new MFA prompts or alerts. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-bypass-microsoft-365-mfa/))
Deep Mailbox Access Enables Vendor Fraud
With access to Exchange Online, SharePoint, Microsoft 365 Search, and a shared accounts-payable mailbox, the attackers monitored existing vendor invoices, payment conversations, and internal workflows. Over about 30 days, they impersonated legitimate vendors using a free webmail address to request changes in payment methods—specifically switching to ACH—providing fake bank and tax documents. Then they mimicked an internal senior AP employee via a look-alike domain to escalate those fake vendor bank‐detail changes through the finance team’s approval stage. The compromised mailbox access let them monitor real conversations so the fraud seemed part of normal business. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-bypass-microsoft-365-mfa/))
Stealth Tactics and Clean-Up Tricks
To cover their tracks, the attackers set up three malicious email rules. These rules archived vendor notice emails, marked them read, and blocked new relevant messages from triggering alerts. They also deleted emails likely to expose the scheme—especially overdue notices from real vendors—thus suppressing internal signals of fraud. Evidence included session logins from Amsterdam and Los Angeles within a minute—attack patterns flagged by “impossible travel” but unnoticed at the time due to the stolen session approach. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-bypass-microsoft-365-mfa/))
Defensive Measures That Matter
Organizations are urged to monitor for impossible-travel sign-ins, unexpected mailbox-rule alterations, unusual token or session activity, and missing or deleted vendor communications. Where supported, enabling token protection and ending active sessions after suspect logins are key steps. For approving vendor payment instructions, it’s advised to require dual approvals plus out-of-band (e.g. phone-based) verification through trusted channels. Finally, the adoption of phishing-resistant authentication methods (e.g. hardware keys) is recommended to reduce risks from attacks that relay valid MFA completions. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-bypass-microsoft-365-mfa/))
Indicators of compromise tied to this campaign include specific sender addresses (e.g. “cs@bitcrazy[.]com”), spoofed display identities using HR-themed domains (“alerting-services[.]com”), redirect URLs from SendGrid, and use of fake domains during the AiTM sign-in process. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-bypass-microsoft-365-mfa/))
This case demonstrates that MFA is not a silver bullet—when attackers can intercept live sessions, they bypass common protective measures entirely. Identity security must evolve beyond passwords and codes to include session protection, mailbox monitoring, and robust approval workflows for financial changes. Operational vigilance and stronger authentication frameworks will be vital to stop the next wave of session-theft scams.
