Alert: Hackers can now bypass MFA without using malware
A recent information security incident targeting the Microsoft 365 account of a finance employee has raised serious warnings about risks to corporate identity management systems. By tampering with the login process, attackers gained access to the mailbox and redirected vendor payments. Notably, this campaign used no malware, infostealers, or remote access tools on the victim's device.
Phishing method via spoofed HR notice emails
According to analysis from researchers at TrendAI, this business email compromise campaign was conducted entirely in the cloud environment. Attackers began by sending a personalized phishing email to the finance employee. The email used a subject line notifying that a leave request was denied, accompanied by the victim's exact name, job title, and organizational information to increase credibility.
The email content instructed the recipient to check overlapping dates via a button embedded with a SendGrid tracking link. When the user interacted, the system executed a series of automated redirects, taking the victim to a fake Microsoft 365 login page controlled by the attacker.
Multi-Factor Authentication (MFA) bypass mechanism via AiTM technique
The fake login page operates as a relay channel following the Adversary-in-the-Middle model. When the user enters account credentials and completes Multi-Factor Authentication (MFA) approval, the website sends that data to the official Microsoft service in real time. As soon as the legitimate system successfully authenticates and generates a session cookie, the attacker captures this identifier.
After obtaining the session cookie, attackers performed a session replay technique from commercial Virtual Private Network (VPN) infrastructure. This method allowed them to directly access the Microsoft 365 system as a legitimate user without re-entering passwords or MFA codes. By exploiting mailbox access, attackers selected an opportune moment to send emails modifying payment details in order to divert funds into bank accounts under their control.
Anomalies and challenges for identity security
Investigation of telemetry data on Microsoft 365 recorded account access logins occurring almost simultaneously from Amsterdam and Los Angeles, with a time difference of only about one minute. This impossible travel pattern served as clear evidence that the login session had been compromised.
This case reflects a critical weakness in identity-based security. Although MFA plays an essential role in preventing conventional password guessing or theft, this solution can still be bypassed if users complete the authentication process on a relay channel set up by attackers. Current attack trends indicate that risks are shifting from harvesting raw credentials to hijacking successfully authenticated browser sessions.
The aforementioned Microsoft 365 account takeover incident demonstrates that cybersecurity risks are increasingly focusing on cloud identity manipulation scenarios. Accurately identifying session tampering mechanisms will help organizations be more proactive in reviewing and reinforcing access control policies for their information systems.
What should enterprises do to defend themselves?
From this incident, it is evident that standard Multi-Factor Authentication (MFA) features (such as sending codes via SMS or authenticator apps), while very effective, can still be bypassed if users drop their guard. To protect organizations, technology experts recommend:
Upgrade authentication methods: Consider using physical security keys (such as FIDO2/WebAuthn). These devices are specifically designed to resist session-stealing phishing attacks.
Tighten access policies: IT teams need to establish strict rules on cloud platforms. For example: Automatically lock accounts immediately upon detecting logins from geographically distant locations in a short timeframe (Impossible Travel), or limit the lifespan of "session cookies."
Train personnel: The best defense technology remains human beings. Regularly remind employees to carefully inspect email links, especially those concerning personal benefits or unexpected wire transfer requests.
Information security is a race with no finish line. As security tools become increasingly sophisticated, hackers also quickly devise new deceptive tactics. Understanding their operational mechanisms is the first step for businesses to build a solid fortress for themselves.
Refer to: AdSecVN
