Someone Stole a Microsoft 365 Session: Why a Password Reset Isn't Enough

Short answer: No, a password reset alone usually isn't enough after someone steals a Microsoft 365 session. A stolen session lets an attacker stay signed in without the password, and attackers often leave other ways back in: a device registered to the account, their own MFA method, a hidden inbox rule, or an app with access to the mailbox. Clean up in order: shut down every sign-in session and reset the password together, remove devices and MFA methods you don't recognize, remove inbox rules and forwarding, review app access, then check what the attacker saw.

What is a stolen session (token theft)?

Think of a concert. Your password and MFA are the ticket you show at the gate. Once you're in, you get a wristband, and nobody checks your ticket again. In Microsoft 365, that wristband is a sign-in token.

In token theft, the attacker doesn't steal the ticket. They copy the wristband. A common way is a fake sign-in page that passes your real login and MFA prompt through to Microsoft, then keeps the token Microsoft hands back. Because the token was issued after MFA, the attacker doesn't have to pass MFA again.

Those fake pages are sometimes reached through a printed code. See our guide to QR code phishing.

Why doesn't a password reset stop it?

Two reasons.

First, sessions that are already open may keep working for a while after a password change. Microsoft's own guidance for cutting off access in an emergency includes revoking the user's sign-in sessions and dealing with their devices, not just changing the password.

Second, a smart attacker doesn't rely on the stolen session for long. Security researchers tracking recent Microsoft 365 token replay attacks have seen attackers register their own devices to accounts, wipe and replace MFA methods, and create hidden inbox rules. A password reset alone leaves those rogue devices and MFA methods in place.

What's the cleanup order?

Hand this list to your IT team and ask them to work through it in order:

1. Revoke all sign-in sessions and reset the password at the same time, so every copied wristband stops working and the old password is useless.

2. Remove devices you don't recognize from the account.

3. Remove MFA methods you didn't add, then re-register the person's sign-in on a phone you trust, running an up-to-date Microsoft Authenticator app.

4. Remove inbox rules and forwarding the attacker set up. Here's how to check Microsoft 365 for hidden inbox rules.

5. Review apps with access to the mailbox or files, and remove any nobody approved.

6. Check what was seen or sent. If the attacker could have read or sent payment emails, call anyone with a pending payment using a phone number you already know, not one from an email.

7. Keep a dated record of each step: what you found, what you removed, and who did it.

How do we stop it happening again?

• Use phishing-resistant sign-in for admins and anyone who moves money. A fake sign-in page has a much harder time with it. See the best phishing-resistant login for small firms.

• Tie sign-ins to managed devices where your setup allows it, so a copied token used from someone else's computer gets stopped.

• Get alerts when a new device, MFA method, or inbox rule shows up on an account, and make sure someone actually reads them.

• Teach staff the common tricks, like device code phishing and fake IT help desk calls.

• Confirm any bank-detail change by phone. Our post on deepfake voice and wire fraud covers why.

When someone leaves the firm, a lot of the same cleanup applies. Our Microsoft 365 offboarding checklist walks through it.

How does 24uNet help?

Our identity threat detection and response watches for signs that someone is using a stolen sign-in, like new devices, new MFA methods and new inbox rules, so we can step in. The habits above are part of our Security Baseline, and you can run through the Security Baseline checklist yourself.

FAQ

Does resetting the password log out an attacker? Not reliably on its own. Revoke sessions at the same time as the reset, then remove anything they added.

What is token theft? Stealing the proof of a completed sign-in so an attacker can use the account without the password or MFA.

Does MFA stop token theft? Not once the token is stolen. Phishing-resistant sign-in makes the theft much harder.

How do we know if they set up a forwarding rule? See our guide to hidden inbox rules in Microsoft 365.

Should we tell clients? If client data or payments may be involved, talk to your attorney and insurer about notice.

Think an account was taken over?

If something looks off, reach out to us, call Denver (303) 468-5515 or College Station (979) 256-5100, or email sales@24unet.com. We're happy to talk it through.

References

• Microsoft, Revoke user access in an emergency

• Microsoft, Responding to a compromised email account

ABOUT THE AUTHOR

Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. Cyber AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.