--- title: The Phish Your Email Filter Will Never See: Why MFA Alone Is Not Stopping Microsoft 365 Takeovers - Capstone Technologies Group description: Adversary-in-the-middle phishing steals live Microsoft 365 sessions past MFA and your email filter. What it costs a small firm, and five fixes for your tenant. canonical_url: https://captechgroup.com/resources/blog/phish-your-email-filter-will-never-see-mfa-microsoft-365-takeovers language: en-GB date: 2026-10-12T19:58:26Z notice: This is a machine-friendly version of the page at https://captechgroup.com/resources/blog/phish-your-email-filter-will-never-see-mfa-microsoft-365-takeovers. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 2283 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/resources/blog/phish-your-email-filter-will-never-see-mfa-microsoft-365-takeovers. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. A security researcher recently timed how long it takes to build a working phishing site from scratch: under 24 minutes from registering the domain to a live page collecting passwords, and half of that was waiting on DNS. The domain cost about a dollar. That is the thing your email filter blocks. The block shows up in your monthly report, the report looks healthy, and the attacker buys another dollar domain before lunch. The compromise that matters is not happening in email at all. ## Why the login page is real The phishing kits doing damage right now do not show your staff a fake Microsoft page. They sit between your employee and the real Microsoft sign-in service and relay everything in both directions. The page is genuine because it is genuine. Your employee types a real password into a real Microsoft screen and answers a real multi-factor prompt. What the attacker collects is the session token Microsoft hands out at the end of that exchange, and replaying that token opens the mailbox with no second prompt. Microsoft documented one campaign of this design that reached more than 10,000 organizations, and the kits have only become cheaper and more common since. Nothing in the chain of email controls sees this. In the case the researcher examined, the lure came from a genuinely compromised mailbox at a real company, so every sender check passed and there was no attacker address anywhere in the message. Independent analysis of accounts compromised through these kits found that the large majority already had multi-factor authentication turned on. Multi-factor confirms who started the session. It has nothing to say about who is holding it an hour later. The same gap shows up in the other lures that get through. QR codes move the click onto a personal phone, outside your managed browser. A reply dropped into an existing thread from a contact you already trust carries no spoofed header to score. A link that is clean when your gateway scans it and switches to a credential page ten minutes later leaves a clean verdict on record. Each control answers a true question about something the attack never touched. ## What it costs a small firm The operator behind this particular case spent six months building dozens of lookalike domains for manufacturers, staffing agencies, and waste haulers. The purpose was invoice fraud against those companies' customers. That is the business model a stolen session feeds. Once inside your mailbox the attacker reads the payment terms, the approval chain, and which supplier has an invoice due, then sends the fraudulent change request from an account your finance team already trusts. Your counterparties absorb part of the loss, and your name is on the message that caused it. A token issued for your Microsoft identity usually unlocks whatever sits behind it: files, shared drives, chat history, and any other application your staff signed into with the same account. For a medical or dental practice, a law office, or an accounting firm, those mailboxes and drives hold personal data by default, which commonly puts an incident of this shape inside notification regimes you already report under. HIPAA may apply where the account touched protected health information. The hard part is scoping it. Your logs recorded a legitimate, already-authenticated user the whole time, so proving which documents were not opened becomes very difficult, and that is exactly what clients and regulators ask. Insurers have noticed. Multi-factor authentication has been the box most firms check on a cyber insurance application. Carriers and assessors are starting to ask what you do about identity and session behavior instead. ## The practical takeaway Five things, in order. The first four are for whoever manages your Microsoft 365 tenant. 1. Give executives, finance approvers, and administrators phishing-resistant multi-factor, meaning a hardware security key or a passkey. These bind the sign-in to the real domain, so a relay in the middle cannot complete the challenge. Start with the people who can move money or change settings, then widen it. 2. Require a managed, compliant device for sign-in through conditional access, and turn on continuous access evaluation. A stolen token replayed from an attacker's server then fails policy, and revoking a session takes effect in near real time instead of waiting for the token to expire. 3. Review every third-party application your staff have consented to in the tenant and restrict new consents to an admin approval. App consents survive password resets and session revocation, so an unreviewed list is a standing back door. 4. Alert on the things the attack actually produces: successful sign-ins from hosting provider address ranges, new inbox rules that move or delete mail mentioning invoices or payments, new forwarding addresses, and new app consents. The prevention layer will report success. Detection is where this gets caught. 5. When an account is suspected, revoke all sessions and refresh tokens first, then reset the password and re-register multi-factor. In the other order the attacker keeps working while the ticket is marked closed. And make any change to supplier bank details require a phone call to a number you already had on file. And one sentence for staff: a sign-in prompt you did not go looking for is a reason to stop, even when the page looks perfect. The full breakdown, including the detection queries your IT provider should be running, is in our [Threat Intelligence Center write-up](https://captechgroup.com/threat-intelligence-center/phishing-defense-fails-when-email-controls-target-a8a6f4). If you do not know which third-party apps hold standing access to your Microsoft 365 tenant today, a [security assessment](https://captechgroup.com/security-assessment) will produce that list. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-10-12T19:58:26Z", "datePublished": "2026-10-12T19:58:26Z", "description": "Adversary-in-the-middle phishing steals live Microsoft 365 sessions past MFA and your email filter. What it costs a small firm, and five fixes for your tenant.", "headline": "The Phish Your Email Filter Will Never See: Why MFA Alone Is Not Stopping Microsoft 365 Takeovers", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/resources\/blog\/phish-your-email-filter-will-never-see-mfa-microsoft-365-takeovers" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/resources\/blog\/phish-your-email-filter-will-never-see-mfa-microsoft-365-takeovers" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "", "streetAddress": "", "addressCountry": "US" } ] } ```