No. Microsoft 365 multi-factor authentication (MFA) is essential, but it does not make a Microsoft 365 account safe on its own. In a campaign reported this month, attackers stole sessions that were created after MFA was complete and used them without a password (Help Net Security, 23 October 2026). MFA needs checking, not just switching on.
That is not an argument against MFA. It stops most attacks that rely on a stolen or guessed password. The point is that attackers have adapted, and a small business needs to know where the gaps now are.
What did the Huntress case show?
Security firm Huntress tracked an attacker between 14 July and 22 September 2026. It counted 497 successful sign-ins and more than 200,000 failed attempts, and found email accounts broken into at 79 organisations (Help Net Security, reporting Huntress, 23 October 2026).
The victims were sent to a fake sign-in page that passed their real password and MFA prompt through to Microsoft. The attacker kept the session token Microsoft issued afterwards. Because that token exists only once MFA is done, whoever holds it does not have to pass MFA again.
The attacker moved quickly. In one incident the stolen session was used 12 minutes after the victim reached the MFA prompt. In another, the gap was four minutes (Help Net Security, 23 October 2026).
Once inside, the attacker did not stop at reading email. Huntress found:
- At least 48 fake computers registered in victims’ Microsoft directories, so access would outlast the stolen session.
- In 19 organisations, the victim’s existing MFA methods removed and a new one registered within three hours of the first sign-in.
- Inbox rules with names like “.” and “sss” that deleted mail or hid it in obscure folders. In one case, a rule hid every message from the company’s accountant after a payroll email was sent.
A password reset would not have removed the attacker’s own MFA method. That is why the clean-up matters as much as the sign-in.
Why doesn’t Microsoft 365 multi-factor authentication stop session theft?
MFA protects the moment of signing in. A stolen session token skips that moment, because it is the proof that sign-in already happened. The attack works by getting the real person to complete the real sign-in on the attacker’s page.
Not all MFA is equal here. The NCSC says some types give much better protection against phishing than others, and its guidance sets out which to prefer and which pitfalls to avoid (NCSC, Multi-factor authentication for your corporate online services, 26 September 2024). A text message code or an approve-or-deny prompt is better than nothing. It is not the strongest option.
What should a small business check this week?
Seven checks. None needs special tools, and your IT provider can do them in a short session.
- Who has MFA, and what kind? List it per person, including directors and shared accounts. One missing account is enough.
- Look at registered devices. Open the device list in your Microsoft 365 admin area and look for computers nobody recognises. The Huntress devices were all named “DESKTOP-” plus random characters.
- Look at each person’s registered sign-in methods. An authenticator app on an “iPhone” that the person does not own is a red flag.
- Check inbox rules on finance and director mailboxes. Look for rules that delete mail, mark it read, move it to odd folders or forward it outside the company.
- Ask where sign-in alerts go. Someone should see a sign-in from an unfamiliar country or hosting provider, and know what to do next.
- Agree what happens after a suspected compromise. Reset the password, end all active sessions, remove unknown devices and sign-in methods, and check the rules. Resetting the password alone is not enough.
- Brief the team on the fake sign-in page. If a login page appears after clicking a link in an email, close it and go to Microsoft 365 directly.
If you want a wider starting point, our ten-question IT audit checklist covers accounts, devices and backups in an afternoon.
Where does INDIGO IT fit?
INDIGO IT, a managed IT support and cyber security provider in Camberley, Surrey, has supported local businesses for more than 20 years. Microsoft 365 and cloud services, and endpoint and email security, are part of the managed IT support we provide on a fixed monthly per-user model.
We can’t tell you from here whether your accounts show any of the signs above. Someone looking at your tenant can, quickly. If you’d like that conversation, speak to Matt about your Microsoft 365 setup. If you would rather check yourself first, work through the seven points above with whoever looks after your IT.
Frequently asked questions
Is multi-factor authentication enough to protect Microsoft 365?
No. MFA stops most password-based attacks, but a stolen session token created after MFA is complete can be used without it. Check registered devices, sign-in methods and inbox rules as well as switching MFA on.
What is token theft in Microsoft 365?
After a successful sign-in, Microsoft issues a session token that proves it happened. If an attacker steals that token, for example through a fake sign-in page, they can use the account without a password or a second check.
How do I know if a Microsoft 365 account has been compromised?
Look for sign-ins from unfamiliar places, devices nobody recognises, changed sign-in methods and inbox rules that delete or hide mail. Any of these means you should treat the account as compromised and have it checked.
What should I do first if I think an account is compromised?
Reset the password and end all active sessions, then remove unknown devices and sign-in methods and review the inbox rules. Ask your IT provider to check for other affected accounts.
