How can a Microsoft 365 account be hijacked with MFA enabled?
MFA remains important. But a successful MFA prompt does not, by itself, prove that the person using the resulting session is the account owner.
What is Evilginx?
Evilginx is associated with adversary-in-the-middle (AiTM) phishing. A phishing site relays a sign-in to the real service. The person may complete MFA, while the attacker captures a session cookie and reuses the authenticated session. People sometimes search for this as “evil nginx”, “MFA bypass” or “MFA hijacking”. It is not a reason to disable MFA.
Session theft, stolen passwords and extra MFA methods are different problems
A stolen password, a stolen authenticated session and an attacker-registered authentication method can require different remediation. Several can occur in one incident. Investigate the evidence before attributing a compromise to a particular tool; an unfamiliar IP address alone cannot identify Evilginx.
What should IT do after suspected session hijacking?
Follow the compromised Microsoft 365 account recovery checklist. Contain access, revoke sessions, replace exposed credentials and investigate authentication methods, mailbox changes and other access. Do not assume changing a password has completed session-theft recovery.
Reduce exposure to phishing that relays a login
Microsoft’s phishing-resistant authentication strength includes FIDO2 security keys, Windows Hello for Business and suitable multifactor certificate-based authentication. Consider these alongside appropriate Conditional Access policies, device security and user reporting. Conditional Access requires appropriate licensing. Phishing resistance addresses this class of sign-in attack; it does not make an infected device or every stolen session harmless.
Where monitoring fits
A new forwarding rule or unexpected sign-in can be a reason to investigate. Vigil Alerts focuses on those activity changes. It does not claim to block Evilginx, identify every stolen session or replace Microsoft’s authentication controls.
Official references
- Microsoft research: AiTM cookie theft and business email compromise
- Microsoft: phishing-resistant authentication strengths
Reviewed 18 October 2026. Portal labels, permissions and licensed features can change; consult the linked documentation.