Advisory: Persistent MFA Circumvention in an Advanced BEC Campaign on Microsoft 365 Targets

**Executive summary:** Mitiga investigated an attempted Business Email Compromise (BEC) against Microsoft 365 where attackers used adversary‑in‑the‑middle (AiTM) phishing to capture MFA session tokens and rapidly register a second Microsoft Authenticator app, creating persistent account access; the report highlights a design/behavioral weakness in Microsoft 365 that allows adding authentication methods without an MFA re‑challenge and recommends device‑based Conditional Access and monitoring for new authentication method registrations.