MFA Token Replay from Known Residential Proxy Networks

Arnold Chan@slaz

•updated Sep 12, 2026•1•0•2

Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.