Preventing M365 Token Hijacking and Invoice Fraud with Entra ID Conditional Access

The Challenge

A national logistics company experienced an invoice fraud incident after a sales manager's Microsoft 365 account was compromised through a phishing attack. The sales manager clicked a link asking them to verify their Microsoft 365 account, which led to a blank page. Behind the scenes, the attack resulted in the theft of the user's Microsoft 365 authentication token.

The stolen token was then used by an attacker operating from Russia to access the sales manager's Microsoft 365 account. Rather than creating an obviously suspicious new payment request, the attacker modified an existing supplier invoice and changed the bank account details to direct payment to a fraudulent account. The amount involved was approximately $30,000.

The paying administrator attempted to verify the bank account change by calling the phone number listed on the invoice; however, the phone number on the invoice had also been altered. When the call was unanswered, the administrator emailed the sales manager to confirm whether the invoice was genuine. Because the sales manager's mailbox was already compromised, the attacker responded from the legitimate account and approved the payment while impersonating the sales manager.

When the incident was reported by the organisation's IT manager, the key issue was not only the initial phishing link, but the absence of stronger identity, access, and endpoint controls. Conditional access, geographic restrictions, endpoint compliance, and risk-based sign-in controls were not in place, allowing the attacker to use the stolen session token without being challenged or blocked.

The Approach

Understanding the Compromise

• Reviewed the incident sequence to identify how the Microsoft 365 account was compromised and used to authorise fraudulent payment.
• Identified token hijacking as the likely compromise method after the user clicked a Microsoft 365 verification phishing link.
• Explained how stolen authentication tokens can allow an attacker to bypass basic password-based controls and access cloud services as the legitimate user.

Identity & Access Recommendations

• Assessed the organisation's Microsoft identity controls and identified missing protections across conditional access, geographic blocking, endpoint compliance, and sign-in risk detection.
• Recommended Microsoft Entra ID P2 capabilities to strengthen account takeover prevention and reduce reliance on passwords alone.
• Recommended conditional access policies to restrict access based on trusted locations, device compliance, user risk, sign-in risk, and application sensitivity.
• Recommended geo-blocking to reduce the likelihood of successful sign-ins or session use from unexpected international locations.

Endpoint & Session Controls

• Recommended endpoint protection and device compliance controls so that Microsoft 365 access could be limited to recognised, managed, and healthy devices.
• Recommended session controls and token protection strategies to reduce the risk of stolen sessions being reused from unmanaged or suspicious locations.

Payment Verification Controls

• Recommended stronger payment verification procedures, including independent supplier contact records and out-of-band confirmation for bank account changes.
• Advised that invoice approval by email alone should not be treated as sufficient verification when the approving mailbox may itself be compromised.

Lessons for Australian Businesses

This incident illustrates a critical point: multi-factor authentication alone is not sufficient if an attacker can steal an active session token. Token hijacking allows an attacker to bypass password and even MFA prompts entirely, operating as the legitimate user for as long as the stolen session remains valid.

Effective protection requires layered identity controls - Microsoft Entra ID P2 with conditional access, geo-blocking, device compliance, and session lifetime policies - combined with payment process controls that don't rely solely on information contained within the invoice or email thread itself. Independently verified supplier contact details, maintained outside of email, remain one of the most effective defences against invoice fraud regardless of how an account was compromised.