21 hours
From capture to first use
The session was captured on day one and replayed the next morning, putting distance between the phishing sign-in and the replay.
New · Fluency AiTM Module
Fluency neutralizes in real time when others do not.
Adversary-in-the-middle (AiTM) phishing steals Microsoft 365 sessions after MFA succeeds, and most companies never see it. Fluency AiTM Module catches the stolen session the moment it is used and revokes its tokens within seconds.
- Neutralized in real time: the replayed session is shut down the moment it is used, not hours later.
- Immediate response: within seconds, Fluency revokes the user’s sessions and tokens, so the stolen session is dead before the attacker returns. Fluency does this when others do not.
- Built on Fluency’s behavioral state analytics, with a deeper profile of each user’s history and state that a stolen session cannot fit, no matter how long the attacker waits.
- Available now to every Fluency customer and MSSP partner.
The attack it stops
MFA was on. They got in anyway.
An AiTM phishing kit relayed a user's password and MFA code to Microsoft in real time, kept the session that came back, and replayed it 21 hours later from 17 home internet connections. No new MFA prompt was ever shown. Three minutes, start to finish.
The 3-minute explainer
Why it is so hard to catch
The attacker waited 21 hours so the trail would go cold.
The stolen session was issued after MFA succeeded, so it looks legitimate. To tie the replay back to the phishing sign-in, a detection has to remember what happened almost a day earlier and recognize the same session reappearing somewhere else. The longer the gap, the wider that search window gets. In this case, Microsoft rated the risk of every replayed sign-in as none.
17 home IP addresses
Seven states and Canada
Each replay came from a clean residential connection. IP reputation saw nothing; only grouping activity by session exposed it.
0 MFA prompts
The claim came with the session
Every replay inherited the MFA claim from the original sign-in, so the attacker was never challenged again.
Into the weeds
The full investigation: a 16-page paper and a 20-minute SOC training.
Every log field, error code and attacker query from the case, plus the hunts that find it.
Technical white paper
Adversary-in-the-Middle in Practice
A sanitized, log-level reconstruction of a real Microsoft 365 session theft: the relayed capture, a 21-hour wait, replay through 17 residential proxies, scripted Graph reconnaissance of payroll and finance staff, and the browser fingerprints that show a tool ran it. Includes six KQL hunts and a token-theft response playbook.
Download the white paper PDF · 16 pages · no form
Or just watch the video · 19:53
The Unbounded SIEM
Find out whether AiTM has already been in your tenant.
Fluency customers and MSSP partners: ask your Fluency team to turn on Fluency AiTM Module. Everyone else: bring your Microsoft 365 sign-in questions to a live session and see what Fluency finds.