Defending Microsoft 365 Tenants Against AiTM Phishing and Session Theft

As organizations strengthen their perimeter defenses in 2026, cybercriminals have shifted their focus toward bypassing traditional authentication mechanisms. Recent industry research highlighted by Forbes and security analysts at Armour Cyber indicates a sharp surge in Adversary-in-the-Middle (AiTM) phishing kits targeting enterprise cloud environments.

Unlike traditional credential harvesting schemes, AiTM attacks do not merely capture passwords. Instead, they proxy the entire authentication process in real time, allowing threat actors to intercept session tokens and bypass standard Multi-Factor Authentication (MFA) controls.

Understanding the AiTM Threat Model

In an AiTM attack, the adversary positions a malicious reverse-proxy server between the target user and the legitimate Microsoft 365 sign-in portal.

Proxying the Session: The victim receives a sophisticated phishing link and is directed to a proxy server mirroring the authentic Microsoft Entra ID login screen.

Intercepting Credentials: When the user enters their username, password, and standard MFA code (such as an SMS code or standard push notification approval), the proxy forwards these credentials to Microsoft.

Session Token Hijacking: Once Microsoft authenticates the request, it issues a valid session cookie. The attacker intercepts this cookie, allowing them to gain full access to the user's cloud session without needing the password again.

Because the session token remains valid, attackers can maintain persistence, access sensitive files in SharePoint, exfiltrate emails via Outlook Web Access, or modify mailbox rules for subsequent financial fraud.

Key Controls to Strengthen Your Microsoft 365 Posture

To mitigate the risk of AiTM phishing and session hijacking, IT security teams should deploy a layered defense strategy across their Microsoft 365 tenants.

1. Transition to Phishing-Resistant MFA

Standard authentication methods like SMS codes and standard push prompts are susceptible to interception. Industry guidance from Microsoft Learn recommends adopting phishing-resistant MFA methods such as FIDO2 security keys, Passkeys, or Windows Hello for Business. These methods cryptographically bind the authentication response to the specific website domain, preventing reverse proxies from intercepting valid tokens.

2. Enforce Device Compliance with Conditional Access

Combine identity checks with device health requirements. By configuring Microsoft Entra ID Conditional Access policies to require compliant or Entra-joined devices, you ensure that stolen session tokens cannot be replayed from unauthorized external devices.

3. Enable Continuous Access Evaluation (CAE)

Continuous Access Evaluation allows Entra ID to monitor active user sessions in near real time. If critical events occur, such as a user location change, account disablement, or password reset, CAE revokes the active session token immediately rather than waiting for standard token expiration.

4. Audit Mailbox Forwarding and OAuth Grants

Attackers frequently establish persistence immediately after acquiring a session. Regularly audit third-party application consent grants and automated mailbox forwarding rules across your tenant to detect unauthorized access vectors.

Strengthening Cloud Security for Your Business

Securing cloud environments requires ongoing monitoring, proactive configuration management, and tailored security controls. If you want to evaluate your organization's current cloud posture, explore our Microsoft 365 Security Assessment to identify potential misconfigurations, enforce best-practice Conditional Access policies, and harden your identity boundary. You can also view our full suite of Managed IT Services or reach out directly through our Contact Page.