BigBear Microsoft 365 AiTM session-cookie replay via token reuse from new IP

Ankit Mehta@Secvyn

•updated Sep 7, 2026•0•0•0

Detects instances where a user performs an interactive login followed by a non-interactive login within a 1-hour window, where the source IP address and geographical location of both sessions differ. This behavior is indicative of potential session hijacking or token theft where an attacker is using stolen session artifacts from a different location.