---
title: Phishing Attack Bypasses Microsoft 365 MFA to Hijack a Finance Mailbox and Steal Payments
description: Phishing email bypasses MFA, compromising Microsoft 365 account to redirect payments. Learn how to protect against session cookie theft.
canonical_url: https://codekeeper.co/ticker/phishing-attack-microsoft-365-bypass-mfa
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# Phishing Attack Bypasses Microsoft 365 MFA to Hijack a Finance Mailbox and Steal Payments

Phishing email bypasses MFA, compromising Microsoft 365 account to redirect payments. Learn how to protect against session cookie theft.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 24, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A single phishing email gave attackers full access to a finance employee's Microsoft 365 account — no malware required. The attack used a fake "PTO Request Denied" message to lure the victim through a chain of redirects to a counterfeit Microsoft sign-in page that captured their authenticated session cookie in real time, bypassing MFA entirely. With that stolen session, attackers accessed invoices, payment threads, and a shared accounts-payable mailbox. Over 30 days, they impersonated a vendor and an internal colleague to redirect payments to fraudulent bank accounts — while hidden inbox rules buried any alerts. Organizations should enforce out-of-band payment verification and token protection immediately. Source: [Cybersecurity News](https://cybersecuritynews.com/hackers-bypass-microsoft-365-mfa/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphishing-attack-microsoft-365-bypass-mfa%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Software security Critical Flaw Let Any Website Run Code on Machines Used for SWIFT Oct 5, 2026](https://codekeeper.co/ticker/sconnect-vulnerability-swift-users-switch)

[Cyberattacks Chick-fil-A Says Cyberattack May Have Exposed Loyalty Account Data Sep 2, 2026](https://codekeeper.co/ticker/chick-fil-a-loyalty-account-breach)

[BlackFile Cybercrime Group Targets Financial Giants with $3M Extortion Demands Aug 21, 2026](https://codekeeper.co/ticker/blackfile-cybercrime-targets-financial-firms)

[Cyberattacks Silver Fox-Linked Hackers Are Using Fake Software Installers to Blind Windows Defender Sep 2, 2026](https://codekeeper.co/ticker/silver-fox-fake-software-campaign)