In a stark reminder of the ongoing cat-and-mouse game between attackers and defenders, a recent investigation into every alert in customer environments over a three-month period has shed light on the top four threats facing organizations today. The findings, published in Prophet Security’s first quarterly threat report, reveal that identity was the target in roughly half of all confirmed malicious activity, with session hijacking emerging as the top way attackers broke into accounts.
The investigation, which involved 4.7 million questions asked of customer environments between May and July, found that about 93% of alerts were benign, leaving 7% as confirmed malicious. The most striking finding was that identity was the target in nearly half of all malicious activity, with attackers using a combination of password cracking, phishing-resistant MFA bypass, and session hijacking to gain access to accounts.
One key factor predicting success was the authentication method used by attackers. While attempts using passwords were usually blocked by security controls such as conditional access and phishing-resistant MFA, attempts using already-authenticated sessions succeeded repeatedly. This is because standard conditional access checks during authentication do not trigger policies when a replayed session cookie is used. As a result, attackers were able to bypass security controls and gain continuous access to emails in some cases.
The consequences of these attacks were significant, with two common outcomes emerging. First, disabling the account did not always stop the attacker, as they continued using access granted before the account was disabled. In one case, an attacker even changed authentication methods and granted OAuth consents while the security team thought the incident was closed. Second, when credentials were phished instead of sessions being stolen, the timing revealed relay infrastructure, indicating that attackers were using real-time proxy intercepting and relaying credentials and approvals.
Infostealers delivered via browsers emerged as the primary source of stolen sessions, affecting roughly a quarter of the investigated organizations. These infostealers were mostly delivered through web browsers, not emails, using compromised legitimate websites, malicious ads, sponsored search results, and fake CAPTCHA gates to bypass automated sandboxing.
The investigation also highlighted the success of MFA fatigue attacks when allowed by the system. One attacker sent repeated prompts from a residential proxy until the user approved, while another used a combination of brute force, lockout, automatic unlock, and push bombing to register a new device, exploiting the automatic unlock policy.
In light of these findings, organizations must take immediate action to strengthen their defenses against session hijacking and infostealer attacks. This includes implementing robust authentication controls that prevent replayed session cookies from bypassing policies, as well as hardening security measures such as MFA and conditional access. By staying one step ahead of attackers, organizations can reduce the risk of successful account takeovers and protect sensitive data.
As a practical takeaway, we recommend that organizations prioritize the implementation of phishing-resistant MFA, which has proven effective in blocking attempts to bypass authentication controls. Additionally, conducting regular security audits and penetration testing can help identify vulnerabilities and weaknesses that attackers may exploit. By staying vigilant and proactive in their approach to cybersecurity, organizations can minimize the risk of successful attacks and protect their most valuable assets – their users’ identities.
Source: Bleeping Computer — 2026-09-10