Security Advisory: Modern Microsoft 365 Session-Hijacking (AiTM) & Invoice Redirection Scams — Why Basic 2FA Is No Longer Enough

1. Executive Summary

Across Queensland and the Moreton Bay region, Business Email Compromise (BEC) and invoice redirection fraud remain the single highest-cost cyber threat facing local trades, builders, legal practices, medical clinics, and accounting firms. Historically, enabling basic Two-Factor Authentication (2FA) on Microsoft 365 was sufficient to stop unauthorized logins.

In 2026, that is no longer true. Commodity Adversary-in-the-Middle (AiTM) phishing kits (such as Tycoon 2FA and Evilginx) now routinely bypass standard SMS and Authenticator code 2FA in real time—allowing attackers to silently hijack an employee's logged-in Microsoft 365 session, monitor Xero/MYOB/conveyancing threads, and substitute fraudulent bank BSB and account numbers on outgoing PDF invoices.

2. Technical Breakdown: How AiTM Defeats Standard 2FA

Many business owners ask: “How did someone get into our email if we had 2FA turned on and approved the code on our phone?”

• Real-Time Reverse-Proxy Relay: When a staff member clicks a deceptive link (disguised as a SharePoint document, voice message, DocuSign file, or subcontractor quote), they are directed to a reverse-proxy server that mirrors the real Microsoft 365 login screen live.
• Session Cookie Capture After 2FA: As the staff member enters their password and approves the 6-digit Authenticator or SMS prompt, the attacker’s proxy forwards those credentials to Microsoft in real time. Microsoft then issues a valid session authentication cookie—which the proxy intercepts and copies.
• Silent Inbox Persistence: Armed with the stolen session token, the attacker imports the cookie into their own browser without ever needing the password or 2FA code again. They immediately create hidden Inbox Rules (automatically moving replies from key clients to the RSS Feeds or Archive folder) and register a rogue MFA device on the account.

3. How Virtue IT Protects Managed Microsoft 365 Clients

For businesses under a Virtue IT Managed IT or Cybersecurity agreement, we deploy a layered defense designed specifically to neutralize AiTM token theft before an invoice scam can occur:

1. Entra ID Conditional Access & Token Protection: We lock down Microsoft 365 logins so a stolen session cookie is useless on an attacker's machine—enforcing strict Australian geo-fencing, compliant/hybrid-joined device checks, and risk-based sign-in policies.
2. Acronis Cyber Protect Advanced Email Security: Malicious AiTM proxy links, spoofed supplier domains, and weaponized PDF/OneDrive lures are sand-boxed and stripped before they ever land in a staff member's Outlook inbox.
3. Microsoft Defender for Business & Continuous MDR Alerting: Our 24/7 monitoring detects anomalous impossible-travel logins, suspicious inbox-forwarding rule creation, and rogue MFA registrations in real time—automatically revoking active session tokens and isolating the account.
4. Out-of-Band Financial Verification Protocols: We assist local accounting, legal, and trade offices in implementing mandatory voice-call verification workflows and tamper-evident billing notices for any EFT bank-detail changes.

4. Recommended Actions for Local Businesses Today

If your Microsoft 365 tenant was set up years ago with default settings ("Security Defaults" or basic SMS 2FA), take these three steps immediately:

1. Audit Active Inbox Rules & Forwarding: Check every staff mailbox in Outlook Web (Settings → Mail → Rules and Forwarding) for unfamiliar rules hiding or forwarding emails containing words like “Invoice”, “Payment”, “Remittance”, or “BSB”.
2. Move Beyond Basic 2FA to Conditional Access: Require device compliance and location restrictions via Microsoft Entra ID Conditional Access so stolen session cookies cannot be replayed from overseas proxy servers.
3. Enforce Verbal Bank-Change Verification: Establish a strict rule that staff and customers never accept BSB/account changes via email without calling the supplier on a known, previously verified phone number.