'Cookie Bite' Entra ID Attack Exposes Microsoft 365

Researchers at Varonis published a PoC named "Cookie Bite" that extracts Azure Entra ID session cookies (ESTSAUTH and ESTSAUTHPERSISTENT) using a browser extension and PowerShell for persistent cookie-stealing and session hijacking. The technique can bypass MFA, grant persistent access to Microsoft 365 resources (Outlook, Teams, etc.), and is described as evasive and widely applicable; the report details attack stages, detection guidance, and mitigations such as enforcing extension allowlists and monitoring sign-in risk.