The Identity Compromises You Aren't Seeing

Every time a new business considers working with Wirespeed, we look at their previous 90 days of detections together to get a feel for what's been happening and if anything was missed.

What we often see is a surprise to some businesses: suspicious logins on accounts with multi-factor authentication (MFA) enforced, going back weeks, that existing tools never surfaced. These are real sessions on real employee accounts from places those employees have never been.

The sessions typically aren’t flagged because the authentication evidence is clean on the surface: valid credentials, a satisfied MFA prompt, and a valid issued session. This is what identity compromise looks like, and it can be difficult to spot because the details are out of place.

Why stolen sessions look like strong authentication

When a user authenticates, the identity provider issues a session token. The browser stores it and presents it on every request afterward, so the user isn't asked to log in again. The token is proof that authentication already happened, honored until it expires.

A session token asserts how the user proved themselves and carries the authentication context that created it. It’s issued to one browser on one device and isn't designed to travel, but nothing in the exchange prevents the token from being replayed somewhere else, so when an attacker steals a live session, the assertion comes along with it.

A stolen session not only evades controls but also presents as one of the strongest authentication events in the tenant. For example, when Entra ID Protection detects something anomalous — unfamiliar location, new ASN, odd device — it emits a risk signal that turns into an MFA prompt. Satisfy the prompt, and the sign-in risk is marked resolved (depending on configuration).

To an analyst scrolling a queue, this looks like the system caught something, challenged it, and the challenge passed. The platform may not reliably distinguish a stolen session from a legitimate one because the proof of strong authentication is real — it just isn't attached to the person it was issued to anymore.

How attackers steal the session

The prevailing method is an adversary-in-the-middle (AITM) attack. The attacker stands up a reverse proxy that wraps the real login page and sends a phishing lure pointing at it. The victim clicks through, sees the genuine sign-in screen, and authenticates normally, password and MFA prompt included. The proxy sits in the middle of that exchange and copies the credentials and the session token as they pass.

None of this requires the attacker to be present. They build the lure, send the phishes, and come back later to collect whatever sessions have accumulated in the meantime. This is at least partially why the compromised logins we discover are often weeks old before anyone looks at them.

Device code phishing is the tactic we're starting to see more frequently. (Think of a college student adding their smart TV to a parent’s Netflix account using a short alphanumeric code.) The attacker starts a device authorization flow to generate a code, then sends the victim both the code and a real Microsoft URL that will grant the attacker access. The victim signs in at Microsoft's actual page (because that’s genuinely where they are), and the attacker collects the session token behind the scenes from Microsoft. There’s no proxy to detect and no lookalike domain to block.

Sessions are also stolen directly off the endpoint. Infostealer malware can pull live session cookies out of browser profiles, including on unmanaged or personal devices. Malicious browser extensions do the same from inside the browser the employee uses every day. A stolen password is mitigated by MFA; a stolen session token was minted after MFA already succeeded.

Hiding in ordinary traffic

Knowing a session can be stolen doesn't help if the replayed login looks like it came from the employee's own neighborhood. Attackers rent access to residential proxy networks, which route traffic through real consumer devices on ordinary home internet connections.

In March, the FBI warned that buyers of these services can pick an exit address by country, state, and city, and directly named account takeover as a use case: obtain an IP address in the victim's city, sign in with stolen credentials, and the activity is far less likely to be flagged.

Microsoft has documented the same tactic, specifically in business email compromise events, where attackers buy residential IP space matching the victim's location to circumvent impossible travel alerts.

Mobile proxies are a newer iteration, one we're watching closely. Traffic exits through cellular carrier address space, either via malicious mobile apps or apps that pay consumers to share their mobile bandwidth plan. Here, the session presents as an employee checking email on their phone.

How a quiet login can escalate

For years, much of this access went nowhere. If the compromised employee wasn't an administrator or couldn't move money, attackers poked around, found nothing worth the effort, and moved on (or used the victim to forward more phishing attempts).

But attacker attention isn’t as expensive anymore. Talos recently identified ARToken, a phishing-as-a-service platform that automates the entire process: token management, inbox rule manipulation, and keyword monitoring across every compromised mailbox for the words that signal money moving. Reconnaissance that used to require a human is now a simple query.

When evaluating stolen access costs nothing, no account is too unimportant to evaluate. Any email account can be monetized, regardless of what that employee can reach, because the inbox itself is the weapon. An internal email from a compromised colleague's account may clear every filter a business owns. It may bypass perimeter-based controls and exploit a trusted relationship that some security controls do not inspect.

Inbox rule manipulation is one of the most reliable indicators of compromise available, but these indications arrive late.

We’ve clocked attackers moving from account takeover to sending an internal phish in just 47 seconds. That’s a highly automated attack, not a person reading a stranger's inbox and deciding what to do with it. What follows is unfortunately familiar: Someone in finance receives a note from a colleague they email every week, about an invoice they were already expecting, with updated payment details.

Then, the attacker may hide the conversation. A new inbox rule can send replies from that finance colleague straight to an unmonitored folder, and the employee whose account is sending the messages never sees the thread. The fraud runs inside a real mailbox, in a real conversation, with the account owner reading a version of their inbox that has been edited for them.

Inbox rule manipulation is one of the most reliable indicators of compromise available, but these indications arrive late. A rule exists to conceal messages that have already been read and replies that are already coming, so by the time one appears the attacker has been in the mailbox for a while and has likely already sent something.

Containment that doesn’t wait

Catching an identity compromise means treating a successful login as the start of the question, rather than the end of it.

Wirespeed learns where your employees sign in from, on what devices, at what hours, and what the account does once someone’s inside. Departures from that pattern are the signal, and the picture has to be wider than location: a device that doesn't match the person, a session behaving nothing like the employee it belongs to, a new inbox rule quietly filing a colleague's replies where nobody will read them.

With Wirespeed, the verdict and containment happen together: full investigations on signals from 85+ integrations across endpoint, identity, network, SaaS, and cloud complete in milliseconds.* If an identity compromise is suspected, active sessions are terminated, and the employee is forced to reauthenticate. The account is locked down in milliseconds without a human bottleneck.

An attacker holding a valid session token doesn't need to break anything. They need enough to read the inbox, learn who approves the payments, and send an email. Every second that session stays alive cedes the advantage to the attacker. The question is how long you’re willing to wait.

LIGHTNING-FAST SPEED. LASER PRECISION.

Try Wirespeed Today

Start your free 30-day trial >

This article originally appeared in the September 2026 edition of the Milliseconds Matter Newsletter. Subscribe to the newsletter to receive future editions directly in your inbox as we explore what happens when cyber threats move at machine speed and how defenders can keep up.

*Based on 90-day Wirespeed data. Response time refers to how quickly Wirespeed determines whether an alert requires escalation; excludes ingestion-source delays from third-party platforms.

This communication is designed to provide general information on the topic presented and is not intended to construe or render legal or other professional services of any kind. If legal or other professional advice is required, the services of a professional should be sought. Neither Coalition nor any of its employees make any warranty of any kind, express or implied, or assume any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, product or process disclosed. Any action you take upon the information contained herein is strictly at your own risk. Coalition and its affiliates will not be liable for any losses and damages in connection with your use or reliance upon the information. The blog post may include links to other third-party websites. These links are provided as a convenience only. Coalition does not endorse, have control over, nor assumes responsibility or liability for the content, privacy policy, or practices of any such third-party websites.

Copyright © 2026. All rights reserved. Coalition, Wirespeed, and their associated logos are trademarks of Coalition, Inc.