Multi-Factor Authentication (MFA) is the standard baseline for securing Microsoft 365 accounts. By requiring a second factor—like an authenticator app approval or a code—it stops bulk credential-stuffing attacks. However, relying on MFA as a standalone defense creates a false sense of security. Modern phishing techniques bypass standard MFA entirely by targeting session cookies rather than just passwords.
The Mechanics of Session Hijacking
Phishing frameworks like Evilginx do not just steal credentials; they steal the authenticated session.
Evilginx operates as a reverse proxy, acting as a man-in-the-middle between the user and the legitimate Microsoft 365 login portal. The workflow operates in six stages:
- Proxy Setup: The attacker deploys a server running the reverse proxy, cloning the styling of the target login page.
- Link Generation: The proxy generates a custom URL pointing to the proxy server, designed to mimic a legitimate domain.
- Delivery: The link is sent to the user via a targeted email, disguised as a standard document review or password prompt.
- Interception: When the user clicks the link, they see the actual, live Microsoft login page served through the proxy.
- Capture: As the user enters their password and completes the MFA prompt, the proxy intercepts both the credentials and the resulting session cookie.
- Hijack: The legitimate portal issues a session cookie to the user’s browser to keep them logged in. The proxy intercepts this cookie and copies it. The attacker can then load this cookie into their own browser, bypassing MFA entirely and gaining direct access to the mailbox.
Once inside, attackers typically set up silent inbox rules to delete sent mail or redirect invoices, playing a quiet “long game” to intercept financial transactions.
Moving Beyond User Training
Many organizations treat user training as their primary defense against these attacks. While training helps, humans are fallible. Under pressure or distraction, even trained users will click a well-crafted link.
Relying on users to spot sophisticated proxy domains is a weak security model. Instead, you need hard, system-enforced technical controls.
Hard Controls: Conditional Access and Intune
To secure Microsoft 365 against session theft, you must implement Conditional Access policies that restrict access to verified, compliant devices.
Instead of asking “who is logging in?”, your security policies must ask “what device are they logging in from?”.
By integrating Microsoft Intune and enforcing device compliance, you ensure that:
- Only corporate-managed or registered compliant devices can access company data.
- An attacker in possession of a stolen session cookie still cannot log in, because their machine is not registered in your directory as a compliant device.
For personal devices (like mobiles used for email), you can enforce selective compliance policies through Mobile Application Management (MAM) to protect corporate data without violating personal privacy.
MFA is a necessary baseline, but it is not a complete security strategy. True security means deploying controls that are actually real—hardening the identity boundary so that stolen session cookies are useless without a verified, managed device.