Full Report
Learn how cybercriminals bypass Microsoft 365 MFA and steal credentials in a live hacking demo. Discover defense strategies to protect your systems.
Analysis Summary
# Tool/Technique: Microsoft 365 MFA Bypass & Token Hijacking
## Overview
This technique involves bypassing Multi-Factor Authentication (MFA) and hijacking session tokens to gain unauthorized access to Microsoft 365 environments. Instead of brute-forcing passwords, attackers use sophisticated social engineering and Adversary-in-the-Middle (AiTM) tactics to steal active session cookies, allowing them to "stroll through the front entrance" as legitimate users without triggering traditional MFA alerts.
## Technical Details
- **Type**: Technique / Attack Framework (AiTM)
- **Platform**: Microsoft 365 (SaaS), Windows, macOS (via Chrome/Edge browsers)
- **Capabilities**: Session hijacking, MFA exhaustion/bypass, credential extraction, and persistence.
- **First Seen**: Increased prevalence identified in modern tradecraft (2023-2024).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- [T1555.003 - Credentials from Web Browsers]
- **[TA0003 - Persistence]**
- [T1133 - External Remote Services]
- [T1098.003 - Account Manipulation: Additional Email Add-on]
- **[TA0005 - Defense Evasion]**
- [T1550.004 - Use Alternate Authentication Material: Web Session Cookie]
## Functionality
### Core Capabilities
- **Browser Credential Extraction**: Rapidly harvesting stored credentials directly from Google Chrome and Microsoft Edge profile databases.
- **Session Token Hijacking**: Capturing session cookies to clone a user's authenticated state, effectively rendering MFA moot.
- **MFA Bypass**: Utilizing "push fatigue" (MFA Bombing) or proxying the MFA request through an attacker-controlled infrastructure to intercept the response.
### Advanced Features
- **Interconnected System Compromise**: Leveraging a single M365 login to move laterally into integrated third-party applications (SSO).
- **Post-Compromise Automation**: Immediate execution of "shady" tradecraft such as creating new administrative accounts, setting up hidden email forwarding rules, and impersonating C-suite executives for Business Email Compromise (BEC).
## Indicators of Compromise
- **File Hashes**: *N/A (Primarily cloud/memory-based or utilizing native browser files).*
- **File Names**: `Login Data`, `Cookies` (Targeted browser files).
- **Registry Keys**: *N/A*
- **Network Indicators**:
- Look for unusual sign-in locations (Impossible Travel).
- Proxy IP addresses associated with known phishing frameworks (e.g., Evilginx2).
- Connections to defanged domains: `login.microsoftonline.com.[attacker-domain].com`.
- **Behavioral Indicators**:
- Creation of unauthorized Inbox Rules (e.g., moving all incoming mail to "Deleted Items").
- Rapid addition of new MFA methods/devices to an existing account.
- Unusual API calls via Microsoft Graph.
## Associated Threat Actors
- **General Cybercriminals** (utilizing credential marketplaces).
- **BEC Groups** (specializing in financial redirection).
- **State-sponsored actors** (targeting identity providers).
## Detection Methods
- **Behavioral Detection**: Monitoring for "Impossible Travel" (logins from geographically distant locations in a short timeframe) and "MFA Fatigue" patterns.
- **Signature-based detection**: Detecting known phishing landing pages or proxy tool headers.
- **Log Analysis**: Auditing Azure AD/Entra ID sign-in logs for "Success" entries that lack corresponding MFA challenge logs for a new device.
## Mitigation Strategies
- **Prevention Measures**: Implement Phishing-Resistant MFA (FIDO2 keys or Windows Hello for Business).
- **Hardening Recommendations**:
- Enforce Conditional Access policies (e.g., requiring compliant, managed devices).
- Disable legacy authentication protocols.
- Monitor and alert on new global admin creations or mail forwarding rules.
- **Identity Security Assessments**: Regularly audit M365 environments for hidden vulnerabilities and misconfigurations.
## Related Tools/Techniques
- **Evilginx2 / Muraena**: Frameworks used to automate AiTM attacks.
- **MFA Bombing**: Repeatedly sending MFA prompts to a user until they approve.
- **Token Theft**: Malware (Infostealers) designed specifically to exfiltrate browser cookies.