Stolen Session Tokens Let Attackers Bypass MFA for Weeks
Global – October 29, 2026 -- Security provider Wirespeed says reviews of new customers' previous 90 days of detections routinely uncover suspicious logins on MFA-enforced accounts that existing tools never surfaced, some dating back weeks.
The sessions go unflagged because the authentication evidence looks clean: valid credentials, a satisfied MFA prompt and a valid issued session. A stolen session token carries the authentication context that created it, so the assertion of strong authentication travels with the attacker.
Risk prompts can mark stolen sessions as resolved
When Entra ID Protection detects an unfamiliar location, new ASN or odd device, it emits a risk signal that triggers an MFA prompt. Once the prompt is satisfied, the sign-in risk is marked resolved, depending on configuration. An analyst scrolling a queue sees a challenge that passed, not a hijacked session.