Stolen sign-ins: how attackers get past two-step login on Microsoft 365

Two-step login is still one of the best protections you can turn on. But a recent attack on Microsoft 365 accounts is a good reminder that it isn’t a force field. The attackers didn’t need to guess a password or crack a code. They waited for people to log in, then took what came after.

How someone gets in without your password

When you finish logging in, Microsoft gives your browser a token. Think of it as a wristband at an event: once you have it, nobody asks for your ticket again. Whoever holds that token can look like you, without passing two-step login a second time.

Huntress says the attackers got these tokens in two main ways:

• A fake login page that passes everything through. It sits between you and Microsoft. You see the real sign-in and approve the real prompt, but the middleman keeps the token.
• A code on the real Microsoft site. You are talked into entering a code on Microsoft’s genuine sign-in page, which approves the attacker’s sign-in instead of yours. The address bar looks completely normal.

It can move fast. In one case on September 22, the stolen session appeared four minutes after the victim reached the two-step prompt.

What they did once inside

• Locked themselves in. They registered at least 48 fake computers on victims’ accounts. At 19 organizations, they wiped the victim’s two-step methods and added their own within three hours.
• Hid their tracks. They created inbox rules that moved or deleted mail, often with names as short as a single period.
• Used the mailbox. One account sent spam to hundreds of outside recipients. Another sent a payroll-related email to an outside contact.

Here is the part that catches people out: changing the password does not undo all of this. Huntress notes that attacker-added devices and login methods stay in place after a reset.

What a small business should do

• Keep two-step login on, and use passkeys or security keys where you can. They are tied to the real website, so a fake login page has much less to work with. Start with admin and finance accounts.
• Set up Conditional Access if your plan includes it. These Microsoft 365 rules can require two-step login and block risky sign-ins. Huntress says properly set rules can prevent this type of attack.
• Be suspicious of any request to enter a code. If someone asks you to type a code on a Microsoft page and you didn’t start that sign-in yourself, stop and call your IT contact.
• Check your inbox rules. Look for rules you don’t remember, especially ones with odd names or ones that delete or move mail. Do the same for your list of devices and sign-in methods.
• Clean up completely if an account is taken. Sign the user out everywhere, reset the password, then remove any devices and login methods the attacker added.

The bottom line

Two-step login is still worth having. It just shouldn’t be your only layer. If you’re not sure how your Microsoft 365 sign-ins are set up, High Definition Technologies can review them with you and close the gaps.

Sources: Huntress, Help Net Security.