Attackers used fake Microsoft sign-in pages and device-code tricks to steal completed Microsoft 365 login sessions, then replayed those sessions without needing passwords or new MFA approvals. After entering accounts, they registered rogue devices, replaced MFA methods, and hid mailbox messages, sometimes to support payroll-related fraud.
This campaign targeted Microsoft 365 accounts across 79 organizations between July and September 2026, resulting in 497 successful sign-ins without attackers ever needing a victim's password. Attackers used adversary-in-the-middle fake sign-in pages that relayed the genuine Microsoft login and MFA prompt to victims, while silently capturing the session token Microsoft issues after sign-in completes. Because that token is generated after MFA, anyone holding it can reuse it without triggering another MFA challenge. Other victims were compromised through device-code phishing, where they were tricked into entering an attacker-supplied code on Microsoft's own legitimate sign-in page, or through social engineering during an otherwise ordinary login.
The technique succeeded because it did not try to defeat MFA directly. Instead, it waited for the victim to complete the real authentication process and then stole the resulting session. In some cases, the hijacked session appeared from attacker infrastructure within minutes of the victim reaching the MFA prompt, showing how quickly captured tokens were replayed. Because the sign-in and MFA steps looked completely normal to the victim, there was little visible indication that anything had gone wrong.
Organizations can reduce exposure by training employees to treat any unsolicited MFA prompt or device-code request as suspicious, especially if they did not personally start the sign-in. Employees should use known bookmarks or typed addresses to reach Microsoft 365 rather than clicking sign-in links from messages. Administrators and identity teams should monitor for rapid MFA-method changes and new device registrations following unusual sign-in activity. Finance and payroll staff should independently verify any unexpected payment or direct-deposit requests, since attackers in this campaign used compromised mailboxes and hidden inbox rules to intercept payroll-related conversations. Conditional Access policies also played a role in this case, blocking over a thousand sign-in attempts from the campaign's infrastructure at some organizations, which highlights the value of layered access controls alongside user awareness.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers used fake sign-in pages that relayed the real Microsoft login and MFA prompt, capturing the session token issued after MFA completed. Since the token was created post-MFA, whoever held it could reuse it without passing MFA again.
It is a technique where victims are tricked into entering an attacker-provided code on Microsoft's legitimate sign-in page, which allows the attacker to obtain a valid session without needing the victim's password.
They registered rogue devices in victims' directories and replaced existing MFA methods at 19 organizations, often within hours of the initial unauthorized sign-in.
Attackers created rules to hide or delete messages mentioning payroll, direct deposit, bank, or bonus, and to conceal replies from specific contacts, preventing victims from noticing fraud-related correspondence.
You approved MFA. Someone else got into your Microsoft 365 account anyway. An unexpected link says, ‘Sign in to your Microsoft 365 account to continue.’ The fake page relays the real login and MFA, then keeps the finished session token. That’s the catch: MFA was real, but the session was stolen. In this campaign, replayed tokens opened accounts minutes later; rogue devices and hidden payroll emails followed. Unexpected sign-in link or device code? Skip it. Open Microsoft 365 from your own bookmark.
Attackers are using real OAuth sign-in and consent flows to steal access tokens or trick users into authorizing malicious apps. Because the victim signs in through a legitimate identity provider and completes MFA, attackers can gain durable access that may survive password resets. The article…
Threat actors are hijacking existing email conversations, or patiently starting new ones, to build trust before sending a malicious reply. The final message commonly poses as a meeting invitation, secure message, shared file, or important document and leads to credential theft or remote-access…
Cofense analyzed real phishing emails disguised as bidding invitations. The emails send recipients to fake, branded login and device-enrollment pages, then trick them into entering a device code in a genuine Microsoft prompt. Doing so can authorize an attacker’s session without giving them the…
The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…
A widespread campaign used fake Microsoft 365 sign-in pages and device-code phishing to capture legitimate session tokens after users had completed MFA. Attackers replayed those tokens to access corporate accounts, then changed MFA settings, registered their own devices, hid emails, and in one case…
Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…
