How to Fix Office 365 Account Compromise in Edge Despite MFA
Question details
The user needs to secure an Office 365 Business account and investigate the endpoint after experiencing a breach via a pre-authenticated Microsoft Edge session, which bypassed MFA.
- Product
- Office 365 Business, Microsoft Edge
- Device & OS
- Windows
- Scenario
- An attacker gained access to an Office 365 account by exploiting a pre-authenticated session in Microsoft Edge, creating malicious background instances without triggering new MFA prompts.
- Observed behavior
- The account was compromised without unfamiliar IP addresses or MFA requests in Azure logs, but multiple unexpected instances of Microsoft Edge were found running at startup.
Immediately disconnect the affected device from your network to sever any active malicious connections, and ensure you have administrative access to your Microsoft 365 Admin Center from a known, secure device.
Revoke Active Sessions and Audit Security Settings
Immediately invalidate all current authentication tokens to stop attackers who are relying on stolen browser sessions.
When an attacker uses a Pass-the-Cookie technique, they bypass the login screen and MFA entirely. The most effective immediate response is to invalidate all active session tokens globally.
Log into the Microsoft 365 admin center, navigate to 'Users' > 'Active users', select the compromised user account, and click 'Sign out of all sessions'.
While in the user's profile in the admin center, click 'Reset password' to ensure no old credentials can be used to generate new tokens.
Open Exchange admin center or the user's Outlook web settings. Check for and delete any hidden inbox rules or auto-forwarding setups designed to exfiltrate data.
Open the Microsoft Entra ID (formerly Azure AD) portal, navigate to 'Enterprise applications', and revoke permissions for any unrecognized OAuth apps.
Investigate Edge Instances and Clean the Endpoint
Remove the root cause of the token theft, such as injected background processes or malicious browser extensions on the local device.
Enhance Your Offline Security with WPS Office
If cloud-based token theft and online session hijacking are concerns for your sensitive data, consider working offline with WPS Office. It provides a robust, lightweight, and highly compatible desktop alternative to cloud-dependent Office suites.
- 1. Download the installer: Visit the official WPS Office website and download the installer for Windows, Mac, or Linux.
- 2. Install the software: Run the downloaded file and follow the simple on-screen instructions to install the suite.
- 3. Open existing files: Launch WPS Office and directly open your existing Word, Excel, or PowerPoint files without needing online authentication.
Frequently Asked Questions
How can an Office 365 account be compromised if MFA is enabled?
Attackers often use a technique called token theft or 'Pass-the-Cookie'. By extracting the active session cookie from a compromised browser like Microsoft Edge, they can inject it into their own browser, tricking the server into believing they are already authenticated, thereby bypassing the MFA prompt completely.
Why didn't Azure sign-in logs show unfamiliar IP addresses during the breach?
If the attacker injected commands into a hidden background instance of Microsoft Edge running on your actual device, the web requests would originate from your local machine. Consequently, the Microsoft 365 logs would only see your legitimate, authorized IP address.
How do I stop Microsoft Edge from running malicious background processes?
You should check your Windows Startup apps via Task Manager and disable Edge if it's set to launch automatically. Additionally, open Edge Settings, go to 'System and performance', and toggle off the setting that allows background extensions and apps to continue running when the browser is closed.
What should I look for when auditing my compromised mailbox?
Attackers frequently set up hidden inbox rules to forward sensitive emails to external addresses or move security alerts from Microsoft directly into the 'Deleted Items' or 'RSS Feeds' folders to hide their tracks. Always review your Outlook rules and auto-forwarding settings after a suspected breach.
