Why MFA Is Not Enough for Microsoft 365 in 2026

Multi-factor authentication is no longer a complete defense for Microsoft 365. That's not a caveat in the fine print. It's what incident response data shows.

Kroll's research across breach investigations found that 90% of compromised organizations had MFA enabled at the time of the attack. The attacks have moved past the password. Now they go around the second factor entirely, and the tooling to do it rents for $250 a month.

Here's the attack, the numbers, and what actually closes the gap.

How These Attacks Bypass MFA Without Cracking a Single Password

Microsoft built a legitimate feature called the device authorization flow. The original purpose was practical: shared devices like conference room screens, smart TVs, or kiosks are hard to type on, so this flow lets a user complete authentication on a separate device by entering a short code.

Attackers repurposed it.

The attack starts with a phishing email, usually dressed up as a document share notification or a Teams message. It includes a short code. The target goes to microsoft.com/devicelogin, a real Microsoft URL, enters the code, logs in normally, and completes the MFA challenge. Everything looks legitimate because it is. The problem is that the code belongs to the attacker's authentication session, not the user's.

When the user finishes MFA, Microsoft issues a valid OAuth token. That token goes to the attacker. It grants full access to email, OneDrive, SharePoint, and Teams for up to 90 days. No password needed. No MFA prompt again.

The user did everything right. They just authenticated the wrong session.

Huntress Labs calls this category "device code phishing," and their July 31, 2026 report documented a new campaign wave tied to infrastructure they tracked as BL Networks. In a 48-hour window, that campaign produced hundreds of confirmed successful logins.

The Scale Is Not Theoretical

The Kratos phishing-as-a-service platform, which Microsoft Threat Intelligence tracked as SneakyLog, was estimated to be running roughly 15,000 Microsoft 365 phishing campaigns per month. German law enforcement took it down on July 20, 2026. Over 200 servers were seized. The developer was arrested in Indonesia with support from US law enforcement.

That's the good news.

The bad news is that roughly 1,800 paying subscribers already had copies of the software before the takedown. Seizures remove infrastructure. They don't remove technique. Historically, subscribers migrate to a competing platform or redeploy the code themselves. The Kratos takedown disrupted a service. The attack method is still in wide circulation.

A related kit called Kali365 rents for $250 for 30 days, according to FBI and Arctic Wolf reporting. It lists financial services among its target sectors. An attacker running this campaign doesn't need technical skill. They need a credit card and a target list.

What Happens in the Five Seconds After an Account Gets Taken

Getting the session token is the opening move. What comes next is the part most businesses don't account for.

Mitiga investigated a business email compromise case in mid-2026 where the attacker registered a second Microsoft Authenticator app on the compromised account within five seconds of gaining access. That registration requires no additional MFA challenge, because the session token was already marked as "Previously satisfied" by Microsoft.

From that point, even after the company's IT team revoked the stolen session, the attacker could re-authenticate with a valid MFA approval, as if they were the original user. The attacker had persistence. A password reset wouldn't change anything, because the authentication method itself was compromised.

In campaigns documented by Huntress, attackers also created hidden inbox rules that automatically filed away incoming messages mentioning words like "phish" or "invoice." They monitored communications quietly while looking for wire transfer opportunities.

This is why "we have MFA" is a starting point, not a defense posture.

Why Standard MFA Was Never Designed for This

Push notifications and time-based codes from authenticator apps were built to stop password theft. The assumption is: if an attacker steals a password, the second factor blocks them. That model still holds for credential stuffing and brute force attacks.

Device code phishing doesn't steal the password at the door. It waits until the user has completed their MFA challenge, then takes the session token Microsoft issues afterward. The second factor did exactly what it was supposed to do. The attack happened downstream.

CISA has stated this clearly: push notifications and SMS codes are phishable. The only widely available method that cannot be relayed by an attacker's proxy is FIDO2. That includes hardware security keys like YubiKey and Windows Hello for Business. These credentials are cryptographically bound to the registered domain. A stolen token from an attacker's proxy server doesn't work, because the key was never registered to that domain.

Only about 19% of organizations have deployed FIDO2, according to research from Adaptive Security.

What Actually Stops It for a 25-to-200-Person Business

None of these require a security operations center or an enterprise budget. They do require someone who knows how Microsoft Entra ID and Conditional Access actually work.

Block device code authentication entirely. Most businesses in the 25-to-200-person range have no legitimate reason to allow device code flow. Microsoft's Conditional Access policies let you disable it via an Authentication Flows condition. If you don't have a kiosk or shared conference room device scenario that requires it, turn it off. This closes the specific door the Kratos-era attacks walked through.

Require compliant or hybrid-joined devices. A Conditional Access policy requiring an enrolled, compliant device for Microsoft 365 access means device code phishing can't complete. The attacker's request fails at the policy check.

Move admins, finance, and executives to phishing-resistant MFA. Hardware security keys or Windows Hello for Business are the current standard for accounts that can approve payments, elevate permissions, or access sensitive data. These are the accounts attackers move on first. FIDO2 closes the token-relay attack at the protocol level.

Alert on new authentication method registrations. Any time a new Authenticator app is added to an account, that should trigger a security alert. It takes five seconds for an attacker to create persistent access after initial compromise. Detection needs to happen before the next session expires.

Audit OAuth app consents in Entra ID. After an account takeover, attackers frequently register rogue OAuth applications that survive a password reset. A periodic review of consented third-party apps in the Microsoft Entra admin center catches these. Anything unrecognized gets revoked.

Enable Unified Audit Log with at least 90 days of retention. When an incident happens, this log tells you what the attacker accessed, from where, and what they changed. Without it, incident response is guesswork. For businesses in regulated industries, this is also a compliance requirement.

Internal links: for context on how these configurations intersect with Microsoft 365 licensing and permissions management, see what Microsoft 365 actually backs up and our overview of managed IT services.

What This Means in Practice

A growing business in North Jersey or NYC running Microsoft 365 today is running a configuration that was reasonable in 2022. It's not adequate for 2026. The attack tooling has gotten cheaper, more accessible, and more industrialized. The Kratos platform alone was running 15,000 campaigns a month before it got taken down, and the subscribers are still out there.

The businesses that stay ahead of this aren't necessarily spending more. They're spending on the right things: Conditional Access configuration that matches how the business actually operates, phishing-resistant MFA for high-value accounts, and active monitoring for the signs that a session has been hijacked. That's the gap most managed IT relationships are built to close.

---