A business account compromised despite MFA can be confusing: if an employee approved the sign-in challenge, how did someone else get access? In many cases, the attacker did not defeat MFA directly. They gained access to an already authenticated session, persuaded the employee to approve a prompt, or found another way into the account.
MFA is still valuable. It makes stolen passwords harder to use. But when an account may be exposed, changing the password is only one part of the response. The organization should also review active sessions, authentication and recovery methods, connected apps, devices, and mailbox settings.
How account access can get past MFA
A stolen session token or cookie
After a person signs in and completes MFA, the service issues a session token, often stored in a browser cookie. It lets the person continue using the account without repeating the full sign-in process each time. If an attacker steals that token, they may be able to act as the signed-in user until the session is revoked or expires.
A deceptive sign-in page can relay an employee’s login in real time, including the MFA step, and capture the resulting session. This is one reason an employee may have approved a legitimate-looking prompt and still see unauthorized activity later. Microsoft describes this risk in its token theft playbook.
Repeated or misleading MFA prompts
An attacker who has a password may repeatedly trigger authentication requests, hoping the employee will approve one to stop the interruptions. A person may also mistake an unexpected prompt for a routine sign-in. Treat any unrequested MFA prompt as suspicious. Do not approve it, and report it through the organization’s established security channel.
A compromised device or an existing login
If a work device or browser profile is compromised, an attacker may be able to access information or sessions already available on that device. An account might also remain accessible through a previously authorized device, mail client, or application. In these situations, the MFA challenge may not appear again immediately.
Changes to recovery options or connected apps
Attackers may try to add an authentication method, change recovery details, or authorize an app to access email or files. These changes can give them a way back in, even after the employee changes a password. An account can also be exposed through mailbox forwarding, rules, or delegated access that quietly copies or redirects messages.
These are possible routes, not proof of what happened in a particular incident. Review the account’s activity and settings before settling on a cause.
What to do when an account may be compromised
Move promptly, but keep the response coordinated. The employee and the organization’s Microsoft 365 or Google Workspace administrator may need to handle different parts of the investigation.
- Report the incident and limit further exposure. The employee should contact the organization’s IT or security lead using a known-good channel, not by replying to a suspicious email. Do not approve more unexpected prompts. If the device itself may be compromised, ask IT before using it to reset credentials or access administrative tools.
- Contain account access. An administrator can use the provider’s controls to block sign-in or otherwise restrict access while investigating. Revoke active sessions and refresh tokens so an attacker cannot simply continue using an existing login. The exact controls and timing vary by provider, so confirm that sessions were actually invalidated.
- Reset credentials and authentication methods. Change the password from a trusted device, especially if it was reused elsewhere. Review registered MFA methods, phone numbers, recovery email addresses, and other account recovery details. Remove anything the user or administrator does not recognize, and make sure the legitimate employee can still access the account securely.
- Review connected apps and permissions. Check for unfamiliar applications with access to email, files, or other account data. Remove suspicious grants and investigate whether a legitimate-looking app was authorized during the incident.
- Inspect email settings and activity. Look for unexpected forwarding, inbox rules, delegates, or changes to sent and deleted messages. Review sign-in and audit records for unfamiliar activity, new devices, and changes to security settings. Preserve relevant details for the investigation rather than deleting suspicious messages or records.
- Check the device and other affected accounts. Have IT assess the device used during the suspected compromise. If the employee reused the exposed password, secure those other accounts as well. Consider whether the account had access to shared files, administrative tools, or other business systems that also need review.
For additional incident-response context, see this first-hour checklist for a compromised Microsoft 365 mailbox. Microsoft also provides steps for responding to a compromised cloud email account, while Google outlines how administrators can identify and secure compromised accounts.
Is changing the password enough?
No. A password reset can stop someone who only knows the old password, but it may not end an existing authenticated session or remove an attacker’s access through a connected app, added recovery method, or mailbox rule. Confirm that sessions and tokens have been revoked, then review those persistence points as part of the same response.
Administrators should also make sure the employee’s account has not been left with a new authentication method or unexpected account permission. Provider-specific guidance can help teams confirm which controls apply. For a broader look at organizing Microsoft 365 administration, see Zevonix’s overview of Microsoft 365 management for Atlanta businesses.
Reduce the chance of another takeover
Make it easy for employees to report unusual sign-in prompts without worrying that they are overreacting. Provide a clear route for reporting suspicious messages, unexpected authentication requests, or unfamiliar account changes. Train employees to navigate to their usual sign-in page instead of following unexpected links.
Where supported, consider phishing-resistant MFA methods. These are designed to make it harder for a deceptive sign-in page to capture an authentication response. CISA’s guidance on implementing phishing-resistant MFA can help administrators understand the approach and plan adoption.
Regularly review account recovery settings, application permissions, mailbox rules, and sign-in activity. Keep devices protected and current, and make sure administrators know how to revoke sessions and restrict access quickly. For a wider view of how to identify security gaps, read this guide to assessing cybersecurity risks in an Atlanta business.
Frequently asked questions
Can a phishing link steal a session after I complete MFA?
It can, if the link leads to a deceptive sign-in flow that relays the login and captures the authenticated session. That is why an MFA approval does not always mean the session is safe.
What is session token or cookie theft?
A session token or cookie helps a service recognize that a user has already signed in. If someone steals it, they may be able to use the session without entering the password or completing MFA again.
How do we revoke active sessions and tokens?
An authorized administrator should use the identity provider’s account-security controls to revoke sessions and tokens, then verify that access has been restricted. The exact steps differ between Microsoft 365 and Google Workspace.
Should we check recovery methods, connected apps, and mailbox forwarding rules?
Yes. Review authentication and recovery details, app permissions, mailbox rules, forwarding, and delegates. These settings can preserve access or expose messages after a password reset.
Secure the whole account, not just the password
MFA reduces risk, but a response to suspected account compromise should cover the full path back into the account: sessions, tokens, devices, recovery methods, connected apps, and email settings. If your team needs help reviewing account access or strengthening its security processes, contact Zevonix to discuss your IT environment and next steps.