M365 session cookie replay: non-interactive sign-in bypasses MFA from new IP

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects potential Adversary-in-the-Middle (AiTM) session token replay attacks where a user successfully authenticates with MFA and is followed shortly by a subsequent successful login for the same user from a different IP address or device without a fresh MFA challenge, suggesting the use of a stolen session cookie.