Token theft: what MFA no longer covers, and how to shrink the window
Attackers no longer try to break MFA: they steal the session that comes after it. Understanding the life of a token helps you choose the right defences and react fast when one is stolen.
MFA moved the target
As MFA becomes universal, attackers stop stealing passwords and start stealing what comes next: tokens. An adversary-in-the-middle phishing proxy relays the real Microsoft sign-in page, lets the user complete MFA, then captures the session cookie. Malware on an endpoint can extract tokens from browsers and applications. Either way, the attacker replays an already authenticated session: MFA was satisfied — by the victim.
How long a token lives
An access token is short-lived, around one hour by default. But the refresh token and the browser session cookie can obtain new ones for much longer. That lifetime is what makes a theft valuable: until the session is revoked, the attacker keeps access.
Reduce the value of what gets stolen
- Phishing-resistant MFA. FIDO2 keys, passkeys and Windows Hello for Business are bound to the legitimate domain: an AiTM proxy cannot relay them. It is the most effective measure against cookie theft at sign-in.
- Compliant devices. Requiring a managed device for sensitive applications prevents replaying the session from the attacker's machine.
- Token protection. Conditional Access can require the session token to be bound to the device that obtained it. The supported applications and platforms keep evolving: check the current scope before enforcing it.
- Sign-in frequency. For administrators and critical applications, regular reauthentication limits how long a stolen session stays usable.
Continuous access evaluation
Continuous access evaluation (CAE) changes the logic: instead of waiting for the token to expire, compatible services — Exchange Online, SharePoint Online, Teams, Microsoft Graph — are notified of critical events and reject the token almost immediately. Account disabled, password changed or reset, sessions revoked, high user risk: each of these cuts access within minutes rather than an hour. In strict mode, an IP address change outside allowed locations can also invalidate the token.
Good to know. CAE is on by default with compatible clients. The real task is not to neutralize it with a legacy session policy, and to have the signals that trigger it.
Responding to token theft
Resetting the password does not always cut a session already issued. The response includes explicitly revoking the user's sessions, checking added authentication methods, created mailbox rules and granted consents, then searching the sign-in logs for other accounts used from the same addresses.
What an audit checks
- Coverage of administrators by a phishing-resistant authentication strength.
- Policies requiring a compliant device for sensitive applications.
- Session policies: sign-in frequency, persistent sessions, any CAE opt-out.
- Collection and retention of sign-in logs, without which no investigation is possible.