Microsoft 365 Account Takeovers: Your Employee’s M365 Login Got Stolen Even With MFA.

Microsoft 365 Account Takeovers: Your Employee’s M365 Login Got Stolen Even With MFA.

Here’s the thing about MFA: it works great at the front door. Your employee types their password, confirms the MFA prompt, and they’re in. But after that, the system hands them a token, a little digital proof-of-entry that says “this person already checked in, let them through.” That token is what keeps them from re-entering their password every five minutes.

The problem is that whoever holds that token gets in. It doesn’t matter how they got it. And right now, attackers are stealing those tokens at a pace that should make every business owner pay attention. Token theft accounted for 31% of Microsoft 365 breaches last year, according to the 2025 Verizon Data Breach Investigations Report. Researchers at Obsidian Security are now tracking close to 40,000 token theft incidents per day across M365 environments.

That’s not a typo. Per day.

Why MFA Doesn’t Help Here

MFA protects the login. That’s it. Once the token is issued, MFA is out of the picture. The token becomes the key, and it works without any additional checks. Worse, refresh tokens can stay valid for 90 days in some Microsoft environments. They even survive password resets. So if someone steals your employee’s token today, changing their password tomorrow doesn’t kick the attacker out.

This is the part that catches most business owners off guard. You did the right thing. You rolled out MFA. Your people use it. But token theft happens after MFA, not instead of it.

To be clear: MFA is still worth every penny. Without it, attackers don’t need to steal tokens at all. They just use the password. MFA blocks the vast majority of credential-based attacks, and turning it off would be far worse than the problem we’re talking about here. Think of it this way: MFA is the lock on your front door. Token theft is someone climbing through a window. The answer isn’t to remove the lock. It’s to also watch the windows.

How Tokens Get Stolen

Most of the time, it starts with a phishing email. Not the obvious kind with broken English and a Nigerian prince. The new stuff looks like a real Microsoft login page, because it basically is one. The attacker sets up a proxy that sits between your employee and Microsoft’s actual login. Your employee enters their password, completes MFA, and gets into their account like normal. But the proxy captured the token that Microsoft issued, and now the attacker has a copy.

This is called adversary-in-the-middle phishing, and it’s gotten cheap to run. Phishing-as-a-Service kits like Tycoon 2FA (which Europol and Microsoft shut down on March 4, 2026) made it possible for people with almost no technical skill to pull this off. New kits have already replaced it.

There’s also device code phishing, where an attacker tricks your employee into entering a code on the real Microsoft login page. The employee thinks they’re setting up a new device. What they’re actually doing is authorizing the attacker’s session. This approach hit 344 organizations across five countries in February and March 2026, according to Huntress research.

And phishing success rates jumped 400% year-over-year, per SpyCloud’s 2026 report. So these campaigns are working.

The Real Problem Is Visibility

Here’s where we get honest about what most organizations are actually missing. It’s not better prevention. It’s detection.

When an attacker uses a stolen token, your security tools see a legitimate session. The token checks out. The permissions are valid. Nothing triggers an alert, because from the system’s perspective, it’s your employee. Most organizations don’t find out about token-based breaches for months. The Ponemon Institute puts the median at 204 days to identify a breach.

Think about that. Seven months of someone reading your email, downloading your files, and forwarding client data before anyone notices.

The thing that actually catches token theft is knowing what normal looks like for your people. Your CFO’s account accessing the marketing team’s SharePoint at 2am from an IP address in Eastern Europe? That’s not normal. Your HR manager downloading an entire folder of employee records and emailing them to a personal Gmail? That’s not normal either. These patterns stand out to someone who knows the organization, even though the token itself is perfectly valid.

This is what we mean by People-First IT when it comes to security. We’re not just watching whether a login succeeded. We’re watching whether the person behind the login is acting like the person we expect. Where are they? What are they accessing? When? Does it match their job and their patterns?

What You Can Do Right Now

On the technical side, conditional access policies in Microsoft Entra ID can flag logins from unusual locations or unmanaged devices. Token protection features can bind tokens to specific devices so they can’t be replayed from somewhere else. Monitoring tools can watch for bulk email forwards, unusual file downloads, and mailbox rule changes. These are table stakes and we set them up for every client.

But Microsoft’s built-in protections weren’t designed to catch what happens after a token is stolen. That’s where third-party account takeover protection comes in. Tools like Human Security and DataDome focus on bot-driven credential stuffing and automated ATO attempts at the application layer. Those matter, but for M365 environments specifically, we use and recommend IronScales.

IronScales plugs directly into your M365 environment through the Graph API with no changes to your mail flow. What makes it relevant here is the behavioral side. It watches outbound email patterns, flags when an account starts sending high-volume messages at unusual hours or contacting recipients it’s never emailed before. It tracks login behavior, things like new devices, unfamiliar locations, and travel patterns that don’t match the user’s history. When a stolen token is being used to read email and set up forwarding rules, IronScales is one of the tools that actually notices, because it knows what normal looks like for that account.

It also catches the phishing that leads to token theft in the first place. The AI-driven detection layer sits on top of whatever Microsoft’s native filtering misses, which, in our experience, is more than most businesses expect. And as of early 2026, IronScales is the only email security vendor with integrated deepfake protection for Microsoft Teams, which matters as voice and video impersonation attacks become part of the same playbook.

Then there’s the people side. Your team needs to know what phishing looks like in 2026, not what it looked like in 2018. The lures are polished. They look like payment confirmations, salary notifications, shared documents from real colleagues. Your people won’t catch every one, but they need to catch most. And your IT team, whether that’s internal or your MSP, needs to be asking the right questions when something feels off. Not just “did the login succeed” but “does this behavior make sense for this person?”

If you’re not sure what your M365 monitoring looks like today, or whether you’d catch a token-based compromise, that’s a conversation worth having. The Railway.com campaign compromised 350+ organizations in two weeks. Most of them had MFA enabled. The ones that caught it early were the ones watching behavior, not just credentials.

Call us at (303) 664-1182. We’ll walk through your current setup and show you what we’d do differently. That’s what People-First IT looks like.