AiTM MFA approval followed by rapid session token reuse from new IP

Ibrahim Saud@tektrix

•updated Sep 21, 2026•4•0•8

Detects potential Adversary-in-the-Middle (AiTM) phishing activity where a user successfully authenticates to Microsoft 365 with MFA, followed shortly by a session from a different IP address reusing the same session ID without a repeated MFA challenge.