Microsoft 365 phishing kits: what do teams miss after MFA passes?

TL;DR: Microsoft 365 phishing kits can steal session cookies or tokens after a victim completes MFA, making a successful prompt look like a benign login while leaving attacker-held access behind, according to Doppel. The key failure is treating authentication success as proof of trust when the real control gap is session theft and unauthorized authorization.

Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “Anatomy of an Active Microsoft 365 Phishing Kit”.

Key questions

Q: What breaks when MFA is bypassed by token theft instead of password compromise?

A: The control that breaks is the assumption that a successful sign-in proves ongoing trust.

Q: Why do AiTM phishing kits still succeed against MFA?

A: AiTM kits succeed because they capture the authenticated session, not just the password.

Q: What signs show that a phishing campaign is using session theft rather than password reuse?

A: Look for a normal-looking login followed by mailbox rules, app grants, token reuse, device registration, or access from an unexpected client without repeated password prompts.

Practitioner guidance

• Map the compromise to the captured artefact Determine whether the incident involved a password, a session cookie, or an authorization token, because containment and evidence differ for each.
• Revoke active sessions and refresh tokens Use provider guidance to invalidate current access, then verify whether mailbox, file, and app activity stops before assuming the account is clean.
• Harden or block device-code flows Block the flow where the business does not need it, and scope any exception to known use cases with monitoring around approval events.

Bottom line: Microsoft 365 phishing kits can produce attacker access even when the victim completes MFA, because the real target is often the session, not the password.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →