Incident triage
MFA Bypass: 7 Session-Theft Signs
A practical triage path for small teams when a trusted account acts wrong even though MFA is enabled.
Cybermeeno field guide
Signal one
New login alerts may stay quiet
Session theft often reuses an already trusted browser. Check active sessions and token activity, not only password or MFA events.
Cybermeeno field guide
Signal two
Watch actions, not only locations
Mailbox rules, OAuth grants, API tokens, admin role edits, and recovery-email changes are stronger signals than simple geo alerts.
Cybermeeno field guide
Signal three
Extensions can steal the session
Review browser extensions with boring names: PDF helpers, coupon tools, screen recorders, and download managers.
Cybermeeno field guide
Signal four
Check the SaaS control planes
Look at Entra ID, Google Workspace, GitHub, Slack, and helpdesk apps. One stolen session often creates more trusted access.
Cybermeeno field guide
Response
Containment has an order
Revoke sessions first, rotate refresh tokens, reset the password, require MFA re-registration, then review connected apps.
Cybermeeno field guide
After action
Keep proof for the cleanup
Save timestamps, IP and ASN, user agent, session IDs, OAuth grants, changed rules, and admin actions before logs roll over.
Cybermeeno field guide