For years, multi-factor authentication (MFA) has been one of the most effective ways to protect business accounts. And while MFA still can be effective—it’s not enough on its own.
Attackers are increasingly effective at bypassing typical MFA methods like SMS or email codes, not by cracking authentication codes, but by stealing what MFA creates after a successful login: a session token.
This shift means your business needs to start thinking beyond traditional MFA and add another layer of protection. Here’s what you should know about MFA and what you should be doing instead.
How Attackers Get Around MFA
When you log into Microsoft 365 and approve an authentication request, whether through an authenticator app, text message or another method, your browser receives a session token. That token tells Microsoft you’ve already verified your identity, allowing you to continue using services like Outlook and OneDrive without authenticating again every few seconds. Attackers are now targeting those tokens.
Adversary-in-the-middle Attacks
One common method is an adversary-in-the-middle attack. An attacker creates a fake Microsoft login page that closely resembles the real thing. When a user enters their credentials and approves MFA, the fake page passes the information along to Microsoft but also captures the resulting session token.
A user might see the page refresh and assume Microsoft had a temporary glitch, but what’s actually happening is the attacker is using the stolen token to impersonate from another browser or device. Once inside, the attacker can access email, browse files, move laterally through connected systems or create Outlook rules that secretly redirect messages and emails.
Browser Malware Attacks
Another type of attack on the rise: Browser-based malware can be used to steal session tokens that already exist on a device. These attacks are becoming easier to execute, as subscription-based adversary-in-the-middle kits and AI-assisted tools are easy to access and can help attackers quickly create convincing phishing emails, fake login pages, and malicious links without requiring deep technical expertise.
Passkeys: A Necessary Layer of Protection
In response to growing MFA attacks and sophistication of perpetrators, Microsoft is increasingly focused on passkeys.
You’ve probably already encountered passkeys when a website asks if you want to sign in using Windows Hello, facial recognition, a fingerprint or a device PIN. On Windows 11, passkeys can be stored in the device’s Trusted Platform Module (TPM), which is a dedicated security component separate from the operating system. Because credentials are tied more closely to the device and protected by hardware, they are significantly more difficult for attackers or malware to steal. Microsoft is also beginning to steer users away from SMS and voice-based authentication and toward stronger authentication methods such as passkeys.
The good news for businesses who use Microsoft tools: Much of this passkey functionality is already built into Windows 11. There may be no additional hardware or software required to start strengthening authentication.
Passkeys Aren’t the Entire Solution
An important thing to remember: Passkeys are an important part of solving the problem, but they don’t eliminate session-token theft after a legitimate login. For more protection, organizations should use Microsoft conditional access policies and risk-based controls to restrict suspicious authentication attempts and more closely tie access to approved devices. These advanced capabilities can require Microsoft Entra ID P2 licensing. Depending on your existing Microsoft licensing, you may already have access to some of these features, or it may make sense to add them for users who need additional protection.
What Your Business Needs To Do With MFA Now
MFA is still essential. The answer isn’t to stop using it, but to strengthen it.
If your organization hasn’t reviewed its authentication policies recently, now is a good time to evaluate the MFA methods your employees are using, if passkeys have been enabled, and whether or not your current Microsoft licensing supports the conditional access protections your business needs.
At Atlantic Data Systems, we’d love to help you with this process to ensure your business is protected. We can work with you to review your existing Microsoft environment, identify gaps and help determine whether additional protections such as passkeys or P2 licensing make sense for your organization.
