MFA relay attacks show why login risk scoring is not enough

At a glance

What this is: This is an analysis of a real-time MFA relay attack that turned a valid employee session into persistent account takeover and evidence suppression.

Why it matters: It matters because IAM teams often trust successful MFA and isolated risk signals, but this case shows how takeover persists when enrollment, mailbox access, and cross-source correlation are not governed together.

By the numbers:

• 365.

👉 Read Artemis Security's analysis of the MFA relay takeover and cross-source detection

Context

Real-time MFA relay attacks break the assumption that a successful second factor proves the user is present and in control. In this case, the attacker phished a password and live code, satisfied the challenge, then converted that short-lived access into persistent identity control by enrolling a new factor and deleting warning emails. For identity teams, the problem is not MFA alone, but how enrollment, session continuity, and downstream application access are governed together.

The primary governance gap is cross-source visibility. Okta saw the sign-in, Microsoft 365 saw mailbox and file activity, and the SIEM saw isolated alerts, but none of those views on their own reconstructed the compromise. That is a classic IAM and NHI lesson: control strength means little when the evidence needed to detect abuse is split across systems and joined too late.

Key questions

Q: How should organisations reduce MFA-related account takeover risk?

A: Start by replacing the weakest factors on the highest-risk accounts, then remove recovery paths that depend on shared secrets or easily intercepted delivery channels. Pair that with risk-based step-up, strong offboarding, and continuous review of fallback access. The goal is to make takeover harder without turning authentication into a usability failure.

Q: Why do successful MFA challenges still lead to compromise in real-world attacks?

A: Because many attacks do not defeat MFA, they replay it. If an attacker steals both the password and the live code, the challenge succeeds exactly as designed. That is why possession-based second factors are weak against relay infrastructure and why continuous session review matters after the login is approved.

Q: What should organisations watch for after a new MFA factor is enrolled?

A: Watch for first-time factor enrollment on accounts that have no prior enrollment history, especially when it follows impossible travel, proxy use, or device anomalies. Also look for deletion of the notification emails that announce the change. Those two signals together often indicate persistence, not a legitimate user update.

Q: Who is accountable when an attacker abuses a valid session to access mail and files?

A: Accountability sits across the identity provider, the downstream application, and the organisation that operates them. The authentication platform may have challenged correctly, but the business still owns factor lifecycle, log correlation, and notification protection. Under most governance models, that makes this an identity control failure, not just an application incident.

Technical breakdown

How adversary-in-the-middle MFA relay defeats possession-based login assurance

A real-time relay sits between the victim and the legitimate identity provider, capturing credentials and one-time codes as they are entered and replaying them before expiry. That means the attacker does not need to bypass MFA cryptographically. They only need to hold both factors long enough to satisfy the session challenge. In this case, the proxy infrastructure and fresh code timing fit that pattern. The key architectural weakness is that many MFA flows still prove possession at a single point in time, not continuous user intent or device binding.

Practical implication: treat password plus OTP as relayable and prioritize phishing-resistant factors for any account that can reach email, admin consoles, or sensitive files.

Why MFA factor enrollment becomes a persistence mechanism

Once an attacker can pass the initial challenge, factor enrollment turns temporary access into durable control. A newly trusted device or method can outlive the original phished session and re-enable future sign-ins without needing another relay. That is especially dangerous when enrollment notifications are the only user-facing warning and the attacker can delete them. For identity governance, factor lifecycle is as important as initial authentication. Enrollment, activation, and revocation are not administrative side notes. They are the point where takeover becomes persistence.

Practical implication: separate login approval from factor-enrollment governance and alert on first-time enrollment, especially when it follows a high-risk sign-in.

Why cross-source session correlation is the difference between suspicion and confirmed takeover

Identity providers, SaaS platforms, and SIEMs often each hold only a fragment of the attack. One sees the login, another sees the mailbox or file activity, and a third sees related alerts that never get stitched together. The shared session ID becomes the decisive join key because it links authentication to post-login behaviour across systems. Without that join, a compromise looks like noise. With it, the same sequence becomes a full intrusion narrative, including evidence deletion. That is the operational boundary between detection and investigation.

Practical implication: centralize IdP, SaaS, and email audit logs and correlate on session identifiers before an attacker can erase the evidence trail.

Threat narrative

Attacker objective: The objective was durable account takeover with downstream access to mailbox content and internal documents while erasing the warning signs that could trigger response.

1. Entry occurred when the attacker phished the employee’s password and live MFA code through a real-time relay, then used the captured session to log into the account from anomalous infrastructure.
2. Escalation occurred when the attacker enrolled their own device and activated trusted MFA factors, turning a short-lived relay into persistent access that no longer depended on the victim’s cooperation.
3. Impact occurred when the attacker accessed Microsoft 365 through the same session, read mailbox content, previewed other employees’ documents, and deleted the Okta alerts that would have exposed the takeover.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• AI LLM hijack breach — attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Real-time MFA relay attacks expose a trust gap, not a broken authentication standard. The account was challenged and the challenge worked, but the attacker controlled both factors in real time. That means the failure is not simple MFA absence. It is the assumption that a successful challenge proves user presence and authentic intent. Practitioners should treat relay resistance as a separate governance requirement, not as a side effect of MFA adoption.

Factor enrollment is a privilege event, not a user convenience feature. Once an attacker enrolls a trusted device, they have converted transient access into a new authentication path. The governance issue is lifecycle control over factor creation, activation, and deletion. In NHI terms, that is credential persistence by another name, and it deserves the same scrutiny as secret rotation and privileged access review. Security teams should classify enrollment as a high-value control point.

Cross-source correlation is now a core identity control, not a SIEM enhancement. Okta, Microsoft 365, and the SIEM each saw valid fragments, but only session stitching revealed the compromise. That is the named concept here: fragmented identity evidence. It describes a condition where every platform is truthful yet none is sufficient on its own. The implication is that identity governance must assume compromise will span products, so investigation design matters as much as authentication policy.

Notification deletion is part of the attack path, not a postscript. The attacker removed the very emails that would have warned the user about new sign-in and new security method enrollment. That turns mailbox access into evidence suppression, which is a distinct control failure from login compromise. IAM programmes need to treat security-notification channels as protected identity assets, because attackers will target them once they have session access.

Standing trust in enrolled factors creates residual access that outlives the original compromise. The moment a hostile device becomes trusted, the attacker gains a reusable credential path that does not depend on the original phished code. This is the same lifecycle problem NHIs create when secrets are never revoked. The lesson for identity teams is to govern trust objects as durable access paths, not as temporary implementation details.

From our research:

• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37%.
• For related guidance, see Ultimate Guide to NHIs , Key Challenges and Risks for how governance gaps turn into persistent access.

What this signals

Fragmented identity evidence is becoming the practical failure mode in modern takeovers. When sign-in, factor enrollment, mailbox activity, and alert deletion sit in different systems, defenders need correlation discipline before they need more telemetry. The programme implication is straightforward: build investigation paths around shared session IDs and lifecycle events, not around alerts in isolation, and align them with the NIST SP 800-53 Rev 5 Security and Privacy Controls.

The security posture issue here is not only authentication strength. It is whether identity teams can see factor lifecycle changes, protect notification channels, and prove what happened after federation hands control to the next platform. With 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps, per The State of Non-Human Identity Security, cross-domain visibility is a governance baseline, not a maturity bonus.

For practitioners

• Require phishing-resistant second factors for high-value accounts Move accounts that can reach email, identity admin, finance, or source-code systems to FIDO2 or equivalent phishing-resistant methods. Treat password plus OTP as relayable and reserve them for low-risk contexts only.
• Alert on factor enrollment as a high-risk identity event Create detections for first-time device enrollment, method activation, and factor replacement when they occur after a high-risk sign-in or from anonymizing infrastructure.
• Correlate IdP and SaaS logs on shared session IDs Join Okta, Microsoft 365, email, and file audit trails on the session ID that survives federation so investigation can reconstruct what the attacker did after authentication.
• Protect security-notification mailboxes from attacker cleanup Flag deletion of sign-in alerts, new-device emails, and security-method notices as suspicious activity because attackers often remove the evidence before the victim sees it.

Key takeaways

• A successful MFA challenge does not prove the session is trustworthy when the attacker can relay both factors in real time.
• The takeover became persistent when the attacker enrolled a trusted device and deleted the notifications that would have exposed them.
• Identity teams need factor-lifecycle controls and cross-source correlation, because separate logs rarely tell the whole story.

Key terms

• Adversary-in-the-middle relay: A relay attack places attacker-controlled infrastructure between the user and the legitimate service, capturing credentials and one-time codes in real time. In identity systems, it defeats simple MFA by replaying valid factors quickly enough to satisfy the challenge while the victim still believes they are signing in.
• Factor enrollment: Factor enrollment is the process of adding a new trusted authentication method to an account, such as a device, push token, or software token. In IAM governance, it is a privileged identity event because it can create durable access paths that survive the original login session.
• Fragmented identity evidence: Fragmented identity evidence occurs when separate platforms each record part of an intrusion but no single system can reconstruct the whole sequence. The result is technically correct logs that still fail operationally because the compromise is only visible after correlation across identity, email, and file systems.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.

What's in the full article

Artemis Security's full article covers the operational detail this post intentionally leaves for the source:

• The exact Okta and Microsoft 365 audit fields that tied the login, factor enrollment, and mailbox activity to one session
• The step-by-step investigation sequence used to reconstruct the intrusion from fragmented logs
• The specific deletion pattern used to remove Okta security notifications from the victim’s mailbox
• The detection workflow Artemis used to separate a valid login from a confirmed account takeover

👉 Artemis Security's full post shows the log joins, event sequence, and deleted evidence behind the takeover.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.