Successful MFA Followed by Rapid Sign-in from Different Device

nomit vyas@xoxo

•updated Jun 25, 2026•3•0•20

Detects a suspicious pattern where a user successfully authenticates via MFA, followed by another successful sign-in attempt for the same account within 10 minutes using a different IP address or user agent. This behavior is often indicative of session hijacking or adversary-in-the-middle (AiTM) attacks where a session token is stolen and replayed from an attacker-controlled environment.