August 6, 2026 Threats 10 min read

Token Theft and AiTM Phishing: Why First-Generation MFA Is Failing Canadian Businesses

By Cybersecurity Canada Editorial Team | Published August 6, 2026

Attackers targeting Canadian businesses have largely stopped trying to break multi-factor authentication. They wait for you to complete it, then steal the session token your identity provider hands back. The result is that an organization which deployed MFA in 2022 and assumes it is protected against phishing in 2026 is, in the median case, mistaken — and Canada is now being singled out for this specific attack.

On April 9, 2026, Microsoft Threat Intelligence published an investigation into a financially motivated actor it designates Storm-2755, noting that "rather than focusing on a specific industry or organization, the actor relied exclusively on geographic targeting of Canadian users." The goal was not data. It was payroll: hijack a Microsoft 365 session, then quietly rewrite the employee's salary-deposit account.

What token theft is, and why MFA does not stop it

Session token theft is the theft of the cookie your identity provider issues after you sign in successfully, rather than the theft of your password. That cookie is proof of an already-authenticated session, so replaying it from the attacker's browser produces access with no password prompt and no MFA challenge. The token remains valid until it expires — by default, hours or days later.

The delivery mechanism is adversary-in-the-middle (AiTM) phishing. The victim receives a phishing email and clicks through to what looks like a legitimate Microsoft 365 or Google Workspace login page. The page is actually a real-time reverse proxy operated by the attacker. When the victim enters their credentials and approves the MFA prompt, the proxy forwards both upstream to the real identity provider, which authenticates the session normally and issues a session cookie. The proxy captures that cookie and replays it.

The critical point for business owners is that nothing was defeated. The password was correct. The MFA prompt was genuine and the user approved it legitimately. Every control worked exactly as designed, and the attacker is still logged in as the user. This is why "we have MFA" is no longer a sufficient answer, and why our guide to multi-factor authentication describes MFA as the floor rather than the ceiling.

A second route to the same outcome is the infostealer ecosystem. Malware harvests saved passwords and live session tokens from infected browser profiles, packages them as "logs," and sells them on criminal marketplaces. Buyers replay the stolen cookies exactly as an AiTM proxy would, with the same result: authenticated access without ever engaging with the user's MFA.

Canada was targeted specifically in the Storm-2755 campaign

The Storm-2755 investigation is the clearest documented case of a financially motivated actor selecting victims by nationality rather than industry. Based on Microsoft's account, the chain ran as follows.

1. Malvertising and SEO poisoning. Storm-2755 positioned an actor-controlled domain (bluegraintours[.]com) at the top of search results for generic queries such as "Office 365" and common misspellings like "Office 265." Victims searching for their own webmail were led to the attacker's page.
2. AiTM credential and token capture. The fake sign-in page proxied the real Microsoft login. Microsoft notes victims saw a sign-in interrupt error (code 50199) at the point of compromise.
3. Token replay. In the compromised sessions, the session ID stayed consistent while the user-agent changed to Axios — an indication the token had been replayed rather than re-authenticated. Persistence showed up as non-interactive sign-ins to the OfficeHome application roughly every 30 minutes.
4. Silencing the victim. The actor created inbox rules to move messages containing the keywords "direct deposit" or "bank" out of the user's inbox, so HR's confirmation of a banking change would not be seen.
5. Redirecting the salary. Storm-2755 then either socially engineered the victim's HR or finance team into updating direct-deposit details, or signed in to Workday as the victim and changed the banking information directly — sending the next payroll deposit to an attacker-controlled account.

Attribution during an active investigation should be read as an assessment rather than a certainty, and this account rests principally on Microsoft's own telemetry. What makes the campaign instructive is step four: the attack was not caught by a failed login, because there was no failed login. It was designed to be invisible in exactly the place a small business would look.

That monetisation route — a hijacked mailbox used to redirect money — is the same pattern behind business email compromise, which remains the most costly single incident category at the small-business scale in Canada.

How much of this is happening in Canada

Canada-specific volume is documented, though incompletely. In its 2025 guidance publication ITSM.30.031 — Defending against adversary-in-the-middle threats with phishing-resistant multi-factor authentication, the Canadian Centre for Cyber Security reported detecting more than 100 AiTM phishing campaigns targeting Canadian Microsoft Entra ID tenants between 2023 and early 2025. That figure counts campaigns the Cyber Centre specifically attributed and tracked, not total national exposure, so it should be read as a floor.

Global campaign data gives a sense of scale. Between April 14 and 16, 2026, Microsoft Defender observed a single coordinated AiTM campaign that reached more than 35,000 users across over 13,000 organizations in 26 countries, using "code of conduct" and HR-disciplinary lures impersonating internal compliance communications. Microsoft reports 92% of that activity was concentrated in the United States, so this campaign was not primarily Canadian — but the most-targeted sectors were healthcare and life sciences (19%), financial services (18%), professional services (11%), and technology and software (11%), all verticals with substantial Canadian SMB populations. The transferable lesson is the lure, not the geography: an HR-themed message about a conduct review is precisely the email an employee opens without thinking.

Why the Tycoon 2FA takedown did not solve the problem

What turned AiTM from a sophisticated technique into a commodity threat is that the tooling has been sold on subscription since 2023. On March 4, 2026, a Europol-coordinated operation with Microsoft and law-enforcement partners across six countries seized 330 domains underpinning Tycoon 2FA, the dominant AiTM phishing-as-a-service platform, which had been linked to more than 64,000 large-scale phishing attacks since 2023. Microsoft tracks the operators as Storm-1747 and had blocked roughly 13 million malicious emails tied to the service in October 2025 alone.

It was a genuine success, and it did not last. Reporting on the aftermath found activity volumes fell to roughly 25% of pre-disruption levels on March 4 and 5, then returned to early-2026 levels within days, with no meaningful change in the operators' tactics — evidence the core service was never fully offline. Displaced affiliates also migrated to competing kits sold on Telegram for a few hundred dollars a month.

The market has continued to add entrants since. Kali365, a phishing-as-a-service platform first observed in April 2026, became the subject of an FBI public service announcement on May 21, 2026, which warned that the Telegram-distributed kit enables threat actors to obtain Microsoft 365 access tokens and bypass MFA without intercepting the user's credentials at all. Reported features include AI-generated phishing lures, automated campaign templates, and OAuth token capture.

For a Canadian small business the practical implication is uncomfortable but clear: this threat is not going to be arrested away. It has to be engineered out.

Which MFA methods actually resist this

The defence is well understood, already licensed in most Canadian SMBs' existing subscriptions, and unusually effective. The distinction that matters is phishing-resistant versus everything else.

• Resistant: FIDO2 security keys and passkeys. The credential is cryptographically bound to the real site's domain, so it will not authenticate to an attacker's proxy — the authentication flow simply breaks. Microsoft's telemetry attributes over 99% prevention of identity-based attacks to phishing-resistant methods. The CCCS names FIDO/WebAuthn and PKI as the phishing-resistant options in its guidance, as does the equivalent guidance from CISA.
• Not resistant: SMS and voice one-time passwords. Relayed straight through an AiTM proxy, and separately exposed to SIM-swapping.
• Not resistant: authenticator app codes (TOTP). The user types the code into the proxy, which forwards it upstream.
• Weak: push approvals without number matching. Vulnerable to relay and to MFA-fatigue prompting. Number matching helps, but does not make push phishing-resistant.

Treat SMS and TOTP as transitional steps, not as the destination. The Canadian Centre for Cyber Security frames authentication as Baseline Control BC.5, and its AiTM guidance is explicit that phishing-resistant MFA continues to prevent these campaigns whether the attacker uses a traditional or a proxy-based kit.

What Canadian businesses should do this quarter

These steps are ordered by return on effort, and all five are available in Microsoft 365 Business Premium or Google Workspace Business without additional purchase.

1. Make passkeys or FIDO2 keys mandatory for the accounts that touch money. Administrators, finance, payroll, HR, and anyone who can change banking details. Not an option for those roles — a requirement. This is the single highest-value control on the list.
2. Shorten session token lifetimes for privileged roles from the default of days to hours, and require re-authentication on token age or a risk signal. A stolen token that expires in one hour is a much smaller problem than one valid for a week.
3. Bind sessions to managed devices and known locations with Conditional Access policies, and scope controls specifically over OAuth device-code sign-in flows, which are now a documented token-theft vector that phishing-resistant MFA alone does not fully close.
4. Alert on suspicious inbox-rule creation. Storm-2755's rules hiding "direct deposit" and "bank" messages are the detection opportunity most small businesses miss, and Microsoft names this alerting explicitly among its recommended mitigations.
5. Add an out-of-band verification step for payment and payroll changes. Any request to change banking or direct-deposit details gets confirmed by a phone call to a number already on file — never a number supplied in the request. This control costs nothing and defeats the entire monetisation step, which is why it belongs in your security awareness training as a documented procedure rather than a habit.

Roll passkeys out to remaining staff over a defined period afterward. Attackers have shifted from exploiting software to exploiting sessions, which is the same lesson the Canada Life breach taught from a different direction: identity is now the perimeter.

How to tell whether it has already happened

Because the sign-in itself looks legitimate, login telemetry is usually the last place a compromise shows up. Most successful AiTM intrusions are first noticed through anomalous mailbox or business-system activity. The indicators worth checking now:

• New MFA methods registered on user accounts that the user did not add
• Inbox rules that forward, delete, or hide messages — particularly ones keyed to finance vocabulary
• OAuth grants to applications nobody in the organization recognises
• Payroll, banking, or direct-deposit changes made from unusual locations or at unusual hours
• Sessions where the session ID stays constant but the user-agent changes, or repeated non-interactive sign-ins on a fixed interval

If you suspect a session has been hijacked, revoking active sessions and tokens matters more than resetting the password. A password reset alone does not invalidate a stolen session cookie, which means the attacker keeps their access while you believe you have removed it. Remove malicious inbox rules, reset MFA methods for the affected accounts, and then work through your incident response plan.

For the wider Canadian threat picture, including how identity attacks compare against ransomware and fraud losses, see The Cybersecurity Canada Report 2026. If you are not certain where your organization stands on authentication and access, our free cybersecurity assessment evaluates you against all 13 Baseline Controls in under 30 minutes, without collecting your data.

MFA has become table stakes rather than a differentiator. The businesses that stay ahead of token theft in 2026 are the ones that stopped asking whether they have MFA and started asking which kind.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Token Theft and AiTM Phishing: Why First-Generation MFA Is Failing Canadian Businesses. Retrieved from https://cybersecuritycanada.ca/news/posts/token-theft-and-aitm-phishing-why-first-generation-mfa-is-failing-canadian-businesses/

Permanent URL: https://cybersecuritycanada.ca/news/posts/token-theft-and-aitm-phishing-why-first-generation-mfa-is-failing-canadian-businesses/ · Published August 6, 2026