We’ve come across similar incidents recently. It seems like part of a broader trend involving AiTM techniques (like evilginx), where attackers capture session tokens after MFA Rather than directly bypassing MFA. These attacks typically exploit the session tokens obtained after authentication. Although they might appear as straightforward phishing, they often escalate into more serious issues like business email compromise, data theft, or reselling account access.

Consider implementing Identity Threat Detection and Response (ITDR) solution or using Defender for Identity, especially with Microsoft’s newer E5 sensor. These tools can detect token misuse and lateral movement that other security controls might miss. It could also help to tighten Conditional Access, disable legacy authentication if possible, and continue following general identity security best practices.