Prevent Microsoft 365 token theft and session hijacking

Hello everyone. My name is Ryan Shenton, and I’m a Senior Cloud Engineer here at Valto.

I typically work on security projects, Microsoft 365 hardening engagements, Microsoft Purview configurations, and tenant migrations.

Today, I’m going to talk about token theft, what it is, how attackers use it, and what you can do to protect your organisation. Token theft has become one of the most common methods used to compromise business accounts. What makes it particularly dangerous is that once an attacker has stolen a valid session token, they no longer need your password or multi-factor authentication (MFA) to gain access.

Microsoft 365 provides several security controls that can help prevent these attacks, but many organisations are either unaware of them or have not yet configured them.

What Is Token Theft?

Let’s begin with a common real-world scenario.

Imagine Sarah Hughes, a Finance Manager at a fictional organisation called Meridian Consulting. Sarah is a typical employee who completes regular security awareness training and generally follows security best practices.

On the other side is an attacker using an automated phishing platform. The barrier to entry for these attacks is incredibly low. Many attackers simply rent phishing infrastructure as a service, allowing them to target thousands of users every day without needing advanced technical skills.

Sarah receives an email that appears completely legitimate. It looks just like the supplier invoices and document-sharing notifications she receives regularly as part of her role. The email contains a specially crafted link designed to capture her credentials and session information.

Modern phishing emails are often very convincing. They no longer resemble the poorly written scams people traditionally associate with phishing. Instead, they closely mimic legitimate business communications.

How Session Hijacking Works

When Sarah clicks the link, she is presented with what appears to be a Microsoft 365 sign-in page.

Although the page looks genuine, the URL reveals that it is not hosted by Microsoft. Everything else on the page can appear completely authentic because the attacker is acting as a man-in-the-middle between the user and Microsoft’s legitimate sign-in service.

A useful analogy is a postal worker who opens every letter, copies the contents, reseals it, and then delivers it as normal. Nothing appears suspicious to either sender or recipient, but the contents have been compromised.

As Sarah signs in, enters her password, and completes MFA, all of this information passes through the attacker’s infrastructure.

Sarah is eventually shown a message stating that the document she attempted to access is unavailable. This often prevents users from immediately reporting the incident because it appears to be a simple error rather than a security issue.

Meanwhile, the attacker receives both the authentication information and, more importantly, the session token generated after successful sign-in.

Why Session Tokens Are Valuable

A session token is designed to improve the user experience.

Rather than asking users to authenticate repeatedly while moving between Microsoft 365 services, the session token confirms to Microsoft that the user has already successfully signed in.

Unfortunately, this convenience benefits attackers as well.

Once a session token has been stolen, an attacker can present it to Microsoft and effectively inherit the user’s authenticated session. They no longer need the password or the MFA challenge because the token itself proves that authentication has already taken place.

What Access Does the Attacker Gain?

With a valid session token, an attacker can gain access to everything the compromised user can access.

This typically includes:

• Email content, both historical and future communications
• SharePoint and OneDrive files
• Sensitive business information
• Customer and supplier correspondence
• Internal business processes and records

Attackers can also send emails from the compromised account. This allows them to reply to existing email threads or impersonate trusted employees when targeting colleagues, customers, or suppliers.

For finance and operations teams, the consequences can be particularly severe. Attackers may alter payment information, redirect invoices, or manipulate sensitive documents.

Compromised accounts are frequently used to expand attacks across the organisation because recipients are far more likely to trust communications from known colleagues.

Why Password Resets Are Not Enough

One common misconception is that resetting a user’s password immediately removes the threat.

In many token theft scenarios, this is not the case.

Because the attacker is using a valid session token, they may remain authenticated even after a password reset. To fully remove the attacker, organisations must revoke active sessions and investigate whether additional authentication methods have been registered.

In some cases, attackers have been known to register their own MFA methods after gaining access, allowing them to maintain persistence even after remediation efforts begin.

Importantly, these attacks often occur without malware being installed on the device. They also require very little technical expertise from the attacker because much of the process is automated.

This is why MFA alone should not be viewed as a complete solution. While MFA is extremely valuable, organisations should implement additional controls to protect against session hijacking.

Detecting Token Theft

Organisations monitoring Microsoft Entra sign-in logs may occasionally identify signs of token theft.

Typically, one sign-in event shows the user completing authentication, followed by another session appearing from a different location or device using the captured session token.

However, identifying these attacks is not always straightforward.

Attackers frequently use virtual machines and hosting services located within the same country or region as the victim. This can make suspicious activity appear legitimate at first glance.

As a result, relying solely on manual log reviews is rarely sufficient.

Using Login Page Branding

One simple security improvement is to brand your Microsoft sign-in experience.

Adding company-specific elements helps users recognise legitimate Microsoft 365 sign-in pages and establishes a visual baseline for what users should expect.

Organisations can customise:

• Background images
• Header logos
• Banner logos
• Sign-in page text
• Browser favicons

While branding will not stop sophisticated attacks on its own, it can help users recognise suspicious sign-in experiences and reduce exposure to simpler phishing campaigns.

Token Protection and Conditional Access

One of the most effective defences against token theft is token protection.

Token protection uses Conditional Access policies to bind session tokens to a specific device. Even if an attacker steals the token, they cannot successfully use it elsewhere because Microsoft validates that the token is being presented from the authorised device.

This significantly reduces the effectiveness of session hijacking attacks.

The good news is that token protection capabilities are included within Microsoft Entra ID P1 licensing, making them available to many organisations already using Microsoft 365 Business Premium or Microsoft 365 E3.

Global Secure Access

Another powerful security control is Microsoft Global Secure Access (GSA).

Global Secure Access establishes a secure connection between managed devices and Microsoft services, ensuring that security checks are continuously enforced.

The technology verifies factors such as:

• User identity
• Device compliance
• Device health
• User roles and permissions

Access is only granted when these requirements are met.

The Microsoft traffic component of Global Secure Access is included with Microsoft Entra ID P1 licensing. Additional capabilities are available through separate licensing options, but they are not required specifically to address token theft.

Additional Security Recommendations

Alongside token protection and Global Secure Access, organisations should consider implementing additional Conditional Access controls.

Recommended controls include:

• Phishing-resistant authentication methods such as passkeys
• Requiring managed devices
• Enforcing device compliance policies
• Risk-based sign-in protections

Risk-based policies use Microsoft’s intelligence and machine learning signals to identify suspicious authentication attempts and can trigger additional verification requirements when elevated risk is detected.

These controls work together to significantly reduce the likelihood of successful account compromise.

How Valto Can Help

Before implementing security controls, Valto typically begins with a security assessment aligned to recognised security frameworks.

This allows us to identify gaps within your Microsoft 365 environment and provide both executive-level and technical recommendations.

Following the assessment, we help organisations implement security controls, harden configurations, and address common areas of risk, including:

• Token theft protection
• Administrative privilege management
• Legacy authentication removal
• Secure sharing controls
• Device compliance
• Ongoing configuration management

Security configurations can drift over time, so maintaining visibility and governance is just as important as the initial implementation.

Closing Thoughts

Although the company and individuals used in this example are fictional, the attack scenario is very real.

Every day, organisations experience account compromise through token theft and session hijacking techniques. The impact can range from financial loss and operational disruption to reputational damage.

Many organisations believe they are protected until an attack occurs. That’s why we recommend taking a proactive approach to security, conducting regular assessments, and implementing a structured remediation plan before an incident happens.

To learn more about Valto’s Microsoft security services, visit the Valto website or contact our team directly.

Thank you very much for watching.