Have you wondered how hacekrs

Have you wondered how hacekrs bypass MFA? Nowadays it is getting easier. There is a phishing kit called Mirage2FA that has been working against Microsoft 365 since late 2024.

Here is how it goes. The user lands on a fake login page. They type their password. They approve the MFA prompt on their phone. Everything they enter is passed straight through to Microsoft in real time, so the sign-in genuinely succeeds and looks completely normal to them. Microsoft issues the session tokens, and the kit keeps a copy.

With those cookies someone can read the mailbox, open SharePoint and OneDrive, and reach anything sitting behind SSO. They never see a second prompt, because the authentication already happened.

ANY.RUN put numbers on it. 9,426 accounts targeted across 3,518 domains, roughly 4,532 showing signs of compromise, most of them in the US. A third of the successful logins happened on phones, where you can barely see the URL you are looking at.

The advice going around is to switch on Continuous Access Evaluation. I would switch it on too. Just read the documentation first, because it does something slightly different to what people assume.

CAE sessions run tokens for up to 28 hours. The default is one hour. What you get in exchange is revocation when something happens, and Microsoft is specific about what counts: the account is disabled or deleted, the password is changed or reset, MFA gets turned on, an admin revokes refresh tokens, or ID Protection flags the user as high risk. Allow up to 15 minutes for that to propagate. IP location is the only one that applies straight away.

Three things worth knowing before you lean on it. It covers Exchange Online, SharePoint Online and Teams. Guest accounts are not supported, which is where a lot of contractor access lives. And it only reads IP-based named locations, so a country-based policy buys you nothing here.

If I were fixing this in a tenant tomorrow, in this order:

Phishing-resistant sign-in first. A FIDO2 key checks the domain it is talking to, so it will not hand anything over to a proxy wearing Microsoft's face.

CAE on, so revocation actually reaches the services.

Then a runbook where you revoke sessions before you reset the password. Reset first and you have changed the lock while someone is still inside holding a key that works.

If session cookies walked out of your tenant this morning, what would notice, and how long would it take?

Source: ANY.RUN threat research, 19 August 2026. CAE behaviour from Microsoft Learn.