MFA Was Enabled. A Stolen Session Still Opened the Door.

A legitimate sign-in can be part of a phishing attack

Adversary-in-the-middle, or AiTM, phishing places an attacker-controlled service between a victim and a real sign-in service. Some campaigns relay authentication and capture the session that follows it. On May 4, 2026, Microsoft described a multi-stage campaign using code-of-conduct notices to move recipients through a convincing sequence before directing them into this kind of authentication flow. Read Microsoft's campaign report.

The practical consequence is that a completed MFA challenge does not, by itself, establish that every subsequent action belongs to the employee. Microsoft's earlier research connected stolen sessions to business email compromise, including activity inside compromised mailboxes. An investigation needs to follow what the account accessed and changed after authentication. See Microsoft's session-theft analysis.

The type of MFA matters

NIST distinguishes phishing resistance from the simple presence of a second factor. Manually entered one-time codes can be relayed to another service. WebAuthn and FIDO2 bind authentication to the legitimate service, providing a stronger defense against an impostor login page. NIST's authentication guidance explains this distinction.

A passkey rollout should also examine enrollment, recovery, and weaker fallback methods. Otherwise, the approved sign-in route may be stronger than the route used when someone loses a device. Protect the endpoint as well: phishing resistance is not a promise that a compromised computer or an already stolen session cannot cause harm.

Investigate access, not just the password

When session theft is suspected, the response should include revoking affected sessions and tokens through the provider's supported controls. Review account activity, forwarding or inbox rules, and other changes that could preserve access. A password reset should not be treated as evidence that every active session or persistence mechanism has been removed. Microsoft's defensive guidance discusses the access patterns defenders need to examine.

For readiness planning, ask one team to identify a suspicious account session and another to demonstrate containment using a test account. Record who has authority to act, which service controls they use, and how they confirm the result. The useful measurement is the time between a credible signal and verified containment, with an evidence trail another responder can follow.

Make authentication testing more specific

An assessment brief should name the accounts, applications, and business actions that matter. We recommend asking whether a low-privilege test account can reach sensitive material, whether a recovery exception changes the result, and which events reach the security team. Use controlled evidence and agreed scenarios so the exercise answers those questions without unnecessary access to real employee information.

Manual penetration testing and red teaming can examine the path from authentication to business impact. BlackSight delivers most pentests on site, including international engagements, and agrees the schedule, scope, and communication with your team. The resulting report should distinguish a sign-in weakness, an access-control weakness, and a response gap so each has a clear owner.