Identity security

How can a session be stolen after MFA?

MFA can succeed while an attacker captures a usable session. Learn which evidence separates a successful sign-in from authorized activity.

The short answer

MFA verifies an authentication event; it does not guarantee every subsequent use of a session is authorized. A phishing proxy or stolen session artifact may allow an attacker to use an already authenticated session, depending on the application and protections in place.

What an analyst should check

Correlate the sign-in and MFA result with the issuing device, token or session identifiers, subsequent IP and device properties, and actions taken after authentication. A new location alone is not proof: proxies and legitimate travel can change network signals.

Review sensitive actions such as mailbox access, app consent, changes to MFA methods, and administrative activity. Preserve the timeline before revoking sessions according to your response process.

What is still unknown

A successful MFA event does not prove token theft, and an unfamiliar session does not establish how the attacker obtained access. Validate the device and user context before naming the mechanism.

Reduce the risk

Use phishing-resistant authentication where practical and evaluate device-bound session protections for supported applications. Layer in session monitoring, sensible access policies, and rapid revocation procedures.

Make the call yourself

The investigation is a fictional, simulated learning scenario. Work through the evidence before reading the outcome.

Investigate an identity alert →