Global – October 29, 2026 -- Security provider Wirespeed says reviews of new customers' previous 90 days of detections routinely uncover suspicious logins on MFA-enforced accounts that existing tools never surfaced, some dating back weeks.
The sessions go unflagged because the authentication evidence looks clean: valid credentials, a satisfied MFA prompt and a valid issued session. A stolen session token carries the authentication context that created it, so the assertion of strong authentication travels with the attacker.
Risk prompts can mark stolen sessions as resolved
When Entra ID Protection detects an unfamiliar location, new ASN or odd device, it emits a risk signal that triggers an MFA prompt. Once the prompt is satisfied, the sign-in risk is marked resolved, depending on configuration. An analyst scrolling a queue sees a challenge that passed, not a hijacked session.
Reverse proxies, device codes and infostealers drive session theft
The prevailing method is adversary-in-the-middle phishing, in which a reverse proxy wraps the real login page and copies credentials and the session token as the victim authenticates. Attackers return later to collect accumulated sessions, which Wirespeed cites as a reason compromised logins are often weeks old when found.
Device code phishing is rising. The attacker generates a code through a device authorization flow and sends the victim the code plus a genuine Microsoft URL. With no proxy and no lookalike domain, there is nothing to block. Infostealer malware and malicious browser extensions also lift live session cookies, including from unmanaged or personal devices.
Residential and mobile proxies defeat location checks
In March, the FBI warned that buyers of residential proxy services can select an exit address by country, state and city, and named account takeover as a use case. Microsoft has documented attackers buying residential IP space matching a victim's location in business email compromise cases to circumvent impossible travel alerts.
Wirespeed is also tracking mobile proxies, where traffic exits through cellular carrier address space via malicious apps or apps that pay consumers to share bandwidth. The session then looks like an employee checking email on a phone.
Automation makes every mailbox worth exploiting
Talos recently identified ARToken, a phishing-as-a-service platform that automates token management, inbox rule manipulation and keyword monitoring across compromised mailboxes for words signaling money movement. Wirespeed says it has clocked attackers moving from account takeover to sending an internal phish in 47 seconds.
The typical fraud pattern: a finance employee receives a note from a colleague they email weekly, about an expected invoice, with updated payment details. A new inbox rule can route that colleague's replies to an unmonitored folder, so the account owner never sees the thread. Wirespeed notes such rules are a reliable indicator of compromise but appear late, after messages have been read and replies are already arriving.
Wirespeed claims millisecond containment across 85+ integrations
Wirespeed says it baselines where employees sign in, on which devices and at what hours, then treats departures from that pattern as the signal. According to the company, investigations drawing on 85+ integrations across endpoint, identity, network, SaaS and cloud complete in milliseconds. When compromise is suspected, active sessions are terminated and the employee is forced to reauthenticate without human intervention.