Most cyberattacks do not start with a sophisticated intrusion. They start with a click on a personal email, a reused password, or a file uploaded to a familiar cloud service because the approved option felt slower.

The Verizon Data Breach Investigations Report found that 68% of breaches involve the human element. 

Not a zero-day exploit. Not a brute-force attack on a hardened system. Human behavior, in the course of an ordinary working day.

For businesses running cloud-based workflows across multiple devices, the personal and professional overlap is now the rule. Understanding where that overlap creates risk is no longer optional. It is a core part of modern security strategy.

The Risk Sitting Outside Your Security Stack

Personal web habits are not reckless behavior. They are normal behavior.

Checking a personal inbox on a work laptop. Logging into a social account during a break. Saving a work password in a browser already loaded with personal accounts. Uploading a document to a storage service because it is faster than the approved option.

None of these feel like security decisions in the moment. But each creates a connection between personal digital activity and business systems, and that connection sits outside most traditional security controls.

Hardening systems, deploying tools, and locking down networks addresses part of the problem. The rest moves with the people.

How Personal Web Habits Create Business Exposure

Personal channels are phishing’s preferred territory

Personal inboxes, messaging platforms, and social media feeds are where phishing thrives. 

These environments are harder to filter, easier to spoof, and loaded with the emotional triggers that make people act before they think.

When those channels share a device or browser with business systems, a single click can cross the boundary instantly.

Phishing is the most common entry method for attackers precisely because it exploits distraction rather than technical weakness. The target does not need to be careless. They just need to be busy.

Password reuse turns personal breaches into work incidents

Password reuse is one of the most direct connections between personal and professional exposure. 

When credentials from a personal account are compromised, attackers run them against business systems automatically. This technique, credential stuffing, is low-effort and highly effective because so many people use the same password across multiple accounts.

Unique credentials for every account, combined with multi-factor authentication, break that chain. 

A personal breach has nowhere to go when the work account requires a second factor that the attacker cannot relay.

Shadow IT is usually about convenience, not defiance

Most unauthorized tool usage does not begin with disregard for IT policy. It begins with a productivity gap. Employees use personal cloud storage, consumer messaging apps, or AI tools because they are faster and more familiar than the approved alternative.

The security risk is not the intention behind the choice. It is what happens to the data. 

Once business information moves into platforms that IT cannot see, audit, or secure, it falls outside every control in place. The tool usage is predictable. The data exposure is not.

Why Blocking Behavior Doesn’t Work

The instinct is to lock things down: block personal apps, restrict browsing, enforce strict device policies.

In practice, blanket restrictions rarely stop the behavior. They relocate it. Users find workarounds. Unapproved tools move to personal devices. IT teams lose visibility into exactly the activity they were trying to manage. 

The risk does not disappear. It moves somewhere harder to see.

Security strategies that assume perfect compliance perform poorly in real workplaces. The goal is not eliminating the overlap between personal and professional digital activity. It is managing it without breaking how people work.

What Actually Reduces Risk

The controls that work are the ones that match how people actually operate.

Separate contexts, not people

The simplest way to reduce crossover risk is to reduce crossover. 

Separate browser profiles for work and personal activity, clear guidance on where business accounts should be accessed, and identity boundaries that prevent accidental mixing all reduce exposure without restricting what people do with their time.

This is not about surveillance. It is about creating enough distance between personal and professional digital activity that a compromise in one does not automatically reach the other.

Design for credential failure

Assume passwords will eventually be exposed somewhere. Design for that outcome rather than hoping to prevent it.

CISA reports that enabling multi-factor authentication makes accounts 99% less likely to be compromised, even when the underlying password has already been stolen.

MFA converts the most common attack path into a dead end. 

Stolen credentials from a personal breach cannot reach a work account that requires a second factor. A password manager handles unique credentials across every account, making that protection sustainable without placing an unrealistic burden on users.

Make secure behavior easier than unsafe behavior

Personal web habits are not dangerous by default. Ignoring the risk they create is. The most secure environments today are not the most restrictive. They are the most realistic: built around how people actually work, designed to contain failure when it happens, and focused on making safer behavior the path of least resistance.

Helping clients reduce human-driven security risk is one of the most impactful services an MSP can offer. 

Contact us or schedule a consultation to review current controls and identify where the most important gaps are.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

It’s a statistic that sends a shiver down the backs of SME owners, managers and employees.  

According to the FBI’s 2025 Internet Crime Report, business email compromise (BEC) cost US businesses more than $3 billion last year.

This makes it one of the most financially damaging cybercrimes on record. 

AI has made these attacks harder to detect. The question for AP teams is no longer whether they can identify suspicious requests. It is whether the processes around payments make fraud difficult regardless of how convincing it looks.

Why AP Teams Are in the Crosshairs

Accounts payable sits at the intersection of trust and timing. AP teams process invoices, manage supplier details, and execute payments, often under pressure to keep operations running smoothly. 

For attackers, that combination is ideal.

Most successful fraud does not involve breaking into systems. 

The FBI’s Internet Crime Complaint Center (IC3)  has consistently found that BEC attacks rely on impersonation. This involves posing as a trusted executive, supplier, or internal colleague to redirect payments or update bank details before anyone notices.

AI has made that impersonation dramatically more scalable. 

Where it once required skill and time to craft a convincing request, tools are now widely available that automate the research, writing, and contextual tailoring that make fraud blend into normal AP workflows.

By mid-2024, an estimated 40% of BEC phishing emails were already AI-generated, with that share expected to grow significantly.

What AI-Enhanced Fraud Looks Like in Practice

Emails that blend into normal workflow

Traditional phishing relied on volume and imperfection. AI has changed that. 

Modern BEC emails are grammatically correct and written in the specific tone of the executive or supplier being impersonated. They reference active projects, current invoice numbers, and upcoming payment runs. 

For AP teams processing high volumes of routine communications, that level of familiarity is exactly what lowers the guard.

Invoice and payment redirection

One of the most common AP fraud patterns involves payment redirection. 

Attackers may intercept a legitimate invoice exchange and quietly alter the destination account. They then send a short message claiming a supplier has updated its banking details, or re-issue a real invoice with minor modifications. 

The surrounding content looks entirely legitimate because, in many cases, it is drawn from real correspondence. 

Voice cloning and executive impersonation

Email isn’t the only channel being exploited. 

AI voice-cloning tools can replicate a person’s voice from a short audio sample. That makes it possible to leave convincing voicemails or place calls that sound like a known executive.

For AP teams accustomed to verbal approvals on high-value or urgent payments, this removes one of the few remaining verification methods that email security alone cannot address. 

Why Traditional Checks No Longer Work

Security awareness training still matters, and investing in it remains worthwhile. But AI has changed what AP teams are up against.

 Attacks no longer contain the signals that training programs once focused on: awkward phrasing, mismatched logos, odd sender addresses, or generic greetings. 

Modern fraud emails can reference the recipient’s organization, active suppliers, and current invoice values drawn from publicly available or previously intercepted sources.

When a fraudulent request is indistinguishable from a legitimate one, placing the burden of detection on the AP team puts it in the wrong place. 

The organizations that reduce risk are not asking staff to be more suspicious. They are building verification processes that work independent of how a message looks.

Building Process Around the Risk

The most effective defense is not sharper instincts. It is removing ambiguity from high-risk actions.

Out-of-band verification as standard

Any request to change supplier bank details or approve an urgent payment outside the normal cycle should require secondary confirmation through a known, independent channel — not a reply to the same email thread. Calling a supplier on a number already on file, or confirming with a colleague directly, breaks the impersonation chain regardless of how convincing the original request appeared. This step does not require technology. It requires a written procedure and the team’s habit of following it.

Layered access and authentication controls

Restricting access to financial systems and enforcing multi-factor authentication limits the damage a compromised account can cause. If an attacker gains access to a vendor’s email, MFA requirements on the receiving end create friction that can slow or stop a fraudulent change before any money moves.

A culture that supports slowing down

Fraud prevention improves when staff feel safe questioning requests, including from senior leadership. 

A team member who pauses a payment to verify it is not being obstructive. They are doing exactly what good process requires. 

Building that culture starts with leadership modeling the behavior and making clear that slowing down on high-risk actions is always the right call.

The FBI’s 2025 Internet Crime Report included a dedicated AI section for the first time, logging more than $893 million in AI-enabled scam losses across more than 22,000 complaints.

When verification is standard and questioning is encouraged, AI-enhanced fraud loses much of its advantage. 

The technology attackers use is advancing quickly, but the process controls that contain the damage do not have to be complicated. They have to be consistent.

Shift the Burden From People to Process

Concerned about AI-enhanced fraud targeting your finance teams or clients? 

Contact us or schedule a consultation to review your current controls and identify where the most important gaps are.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

You click a link, sign in, approve the MFA prompt, and get on with your day. Completely unaware that someone else just logged into your account at the same moment.

That scenario surprises many businesses, particularly those that rely on multi-factor authentication (MFA) to protect cloud accounts. But this is exactly how Adversary-in-the-Middle (AiTM) phishing attacks work. 

Rather than stealing passwords for later use, these attacks silently hijack an already-authenticated session in real time.

MFA remains a core control, and getting it implemented correctly is still a critical first step for any business. 

But AiTM attacks exploit something MFA was never designed to protect: the trusted session that exists after authentication has already completed.

Phishing Has Moved Beyond Passwords

Phishing remains the most common starting point for account compromise, but the objective has changed. 

Traditional phishing collected usernames and passwords. Modern phishing is after something more immediately useful: the authenticated session itself.

Security researchers have documented a significant shift toward session and token theft, where attackers intercept the authentication process as it happens. 

Rather than reusing stolen credentials, which MFA typically blocks, they wait until the user successfully completes login, then steal the session token that proves it already occurred.

The technique has matured quickly. Phishing-as-a-Service (PhaaS) platforms now supply ready-made proxy toolkits that let even low-skilled attackers run AiTM campaigns targeting Microsoft 365 and Google Workspace. 

How AiTM Attacks Actually Work

The fake login page that isn’t fake

An AiTM phishing site is not a basic replica of a login page. It is a live reverse proxy.

The attacker’s infrastructure sits between the user and the real authentication service. Every keystroke, redirect, and server response flows through the attacker’s system in real time. From the user’s perspective, nothing looks wrong. 

The page behaves exactly like the real service, with correct branding, working redirects, and a functioning MFA prompt. In most cases, the only clue is a slightly altered URL that goes unnoticed on a mobile screen or when someone is under time pressure.

Why MFA doesn’t stop it

This is where many security assumptions fall apart.

MFA protects the moment of authentication, not what comes after it. 

Once a user successfully completes MFA, the service issues a session cookie. What this means is that the cookie signals to the application that the user is already verified. From that point, no password or MFA prompt is required. The system trusts the token. Whoever holds the cookie holds the access.

AiTM attacks simply wait for that cookie to be issued then steal it.

Microsoft tracked a 146% rise in AiTM attacks over the past year, as cybercriminals increasingly shift focus to accounts already protected by MFA.

Much of this increase is driven by PhaaS platforms like Evilginx that allow even low-skilled attackers to run convincing reverse-proxy campaigns at scale, targeting major cloud identity providers with minimal setup.

Session cookies

Session tokens act as bearer credentials. So, whoever possesses the token can access the account, with no password or MFA challenge required.

Once the cookie is stolen, the attacker imports it into their own browser and immediately resumes the session. 

This is a session replay attack. The attacker does not log in. They pick up where the legitimate user left off, inside a fully trusted, already-verified session.

What Happens After a Session Is Stolen

The aftermath of an AiTM attack tends to be quiet, which is precisely what makes it dangerous. 

The attacker is operating inside a legitimate, authenticated session. There are no failed MFA attempts, no unusual login alerts, and nothing in standard sign-in logs to signal a problem.

Research from Proofpoint shows that attackers who gain access through session hijacking commonly create hidden inbox rules to redirect mail, register additional MFA methods to lock in persistent access, monitor email threads for financial conversations, and use the trusted account to launch phishing campaigns against internal colleagues or finance teams.

These follow-on actions are a key reason AiTM attacks are frequently uncovered late, after financial fraud, data exposure, or wider network compromise has already begun.

Reducing Your Exposure

MFA is still essential. Building strong authentication practices remains the starting baseline. But reducing AiTM risk requires controls that extend beyond the login event itself.

Adopt phishing-resistant MFA

Methods like FIDO2 hardware keys and passkeys bind authentication to the specific device and the legitimate domain. A proxy in the middle cannot relay them: the process fails if the URL is not the real one. 

The Canadian Centre for Cyber Security analyzed over 100 AiTM campaigns targeting Microsoft Entra ID accounts. It found that phishing-resistant MFA consistently blocked session theft where standard MFA methods (including push notifications and one-time passcodes) did not.

Tighten Conditional Access policies

Risk-based access controls evaluate additional signals, including device compliance, IP location, and session behavior, rather than treating every authenticated session as permanently trusted. 

Configured correctly, these policies can detect and block anomalous access even when a stolen session token appears valid.

Monitor for post-login anomalies

Detecting AiTM compromise typically means watching for activity after login: new MFA method registrations, inbox rules created outside business hours, access from unfamiliar locations, or unusual data activity. 

Authentication logs alone will not surface the problem.

Train users on URL awareness

Employees who understand that a working MFA prompt on an unfamiliar-looking page still represents a risk are better positioned to pause, check the URL, and report before a session is compromised. A brief team walkthrough of what AiTM lures look like in Microsoft 365 contexts can meaningfully reduce exposure.

Stop Protecting Just the Login Screen

MFA is a baseline, not a finish line. The businesses that reduce AiTM risk are the ones that understand how sessions, tokens, and identity trust actually work . And they build controls around each layer, not just the login screen.

Want to review your identity security controls? 

Contact us or schedule a consultation to identify the gaps that matter most before an incident does it for you.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

MFA is a strong front-door lock. But it’s not the only thing that decides whether someone can get in.

After you sign in, your browser keeps you logged in using a session token (often stored as a cookie). It’s the digital version of a wristband at an event: once you’ve been checked, the wristband proves you belong there. If an attacker steals that wristband, they may not need to beat your MFA prompt at all.

That’s the core of session cookie hijacking. The attacker isn’t “cracking” MFA. They’re skipping it by replaying your already authenticated session.

This isn’t a reason to stop using MFA. It’s a reason to stop treating MFA as the finish line. 

When sessions can be stolen, the practical defence shifts to layered controls: phishing-resistant sign-ins, device hygiene, tighter session policies, and detection that catches suspicious access early.

Why MFA Isn’t a “Game Over” Control

MFA is still one of the best upgrades most businesses can make, but it doesn’t end an attack on its own. The reason is that attackers don’t always try to beat the login step. They try to go around it.

Cloudflare notes that “attackers are finding new ways to circumvent MFA” and that modern incidents are rarely one isolated technique. They’re “part of a chain of attacks.” 

In other words, MFA can block a lot of credential theft, but it doesn’t automatically protect what happens after a user successfully signs in. 

That’s where session cookie hijacking comes in. 

Microsoft has described adversary-in-the-middle phishing campaigns where attackers use a reverse-proxy site to “steal and intercept” a user’s password and the session cookie that proves they have an authenticated session. 

This is “not a vulnerability in MFA.” The attacker isn’t breaking the MFA. They’re reusing the session. 

What a Session Cookie Is and Why Attackers Want It

When you sign into a web app, the site needs a way to remember that you’ve already proved who you are. That’s what a session is: a temporary “logged-in” state that saves you from entering your password and MFA code on every click. 

Kaspersky explains that session hijacking is “sometimes called cookie hijacking” because cookies are commonly used to store the session identifier that keeps you authenticated. 

Attackers want that session identifier because it’s the shortcut. 

Proofpoint describes session tokens as digital “keys” that let a user stay authenticated. It warns that stealing valid tokens lets attackers impersonate legitimate users and potentially bypass authentication measures “like MFA.” 

That’s why session cookie hijacking is so highly leveraged. 

If an attacker can steal the cookie or token that represents your active session, they’re not trying to defeat the login process. They’re attempting to reuse what you already completed, and access the same apps and data as if they were sitting at your keyboard.

How Session Cookie Hijacking Actually Happens

A lot of teams picture “account takeover” as someone guessing a password or tricking a user into approving an MFA prompt. 

Session cookie hijacking is different. The attacker’s goal is to steal the proof that you’re already logged in, then reuse it, often without triggering another sign-in challenge.

1.) AiTM phishing 

Adversary-in-the-middle (AiTM) phishing is the “proxy login” trap. 

You think you’re signing into a normal service, but you’re actually signing into a lookalike page that sits between you and the real site. The attacker relays the login in real time, so everything appears to work, including MFA.

Attackers use AiTM phishing sites to “steal and intercept” a user’s password and the session cookie that proves the authenticated session. This is “not a vulnerability in MFA.” The attacker isn’t breaking the MFA. They’re capturing the session after MFA is completed and reusing it. 

One such campaign “attempted to target more than 10,000 organisations” since September 2021, which shows how scalable this approach has become. 

2.) Browser-in-the-Middle session stealing

Browser-in-the-middle (BitM) is similar in spirit, but it’s even more “hands-on” from the attacker’s side. 

Instead of stealing a password and running away, the attacker effectively places themselves in control of the browsing session.

Google’s threat intelligence says, “Stealing this session token is the equivalent of stealing the authenticated session.” Once the token is stolen, “an adversary would no longer need to perform the MFA challenge.” 

In other words, the attacker isn’t trying to authenticate instead of you. They’re trying to ride along after you’ve authenticated.

3.) Cookie theft from the endpoint

Not every session hijack starts with a fancy proxy. Sometimes the attacker simply steals session data from the device itself.

Stealing valid session tokens allows attackers to impersonate legitimate users. Tokens act like digital “keys.” If an endpoint is compromised, those “keys” can be extracted and reused.

Invicti explains that an attacker steals HTTP cookies and can gain access. The goal is often to obtain sensitive information stored in cookies. 

MFA Is a Baseline, Not a Finish Line

MFA is still essential. It blocks a huge amount of credential theft and makes basic account takeover harder. But session cookie hijacking is a reminder that attackers don’t always try to defeat the login step. Sometimes they reuse what happens after it.

The practical response is layered and realistic. Make phishing harder to pull off, and treat device health as part of identity. Tighten session behaviour for high-risk apps. Watch for suspicious access patterns that suggest a session is being replayed.

When those controls work together, MFA stops being a comforting checkbox and becomes what it should be: a strong baseline that’s backed by protections around the session itself.

Contact us today for help protecting your login sessions from hijacking.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

For years, enabling Multi-Factor Authentication (MFA) has been a cornerstone of account and device security. While MFA remains essential, the threat landscape has evolved, making some older methods less effective.

The most common form of MFA, four- or six-digit codes sent via SMS, is convenient and familiar, and it’s certainly better than relying on passwords alone. However, SMS is an outdated technology, and cybercriminals have developed reliable ways to bypass it. For organizations handling sensitive data, SMS-based MFA is no longer sufficient. It’s time to adopt the next generation of phishing-resistant MFA to stay ahead of today’s attackers.

SMS was never intended to serve as a secure authentication channel. Its reliance on cellular networks exposes it to security flaws, particularly in telecommunication protocols such as Signaling System No. 7 (SS7), used for communication between networks.

Attackers know that many businesses still use SMS for MFA, which makes them appealing targets. For instance, hackers can exploit SS7 vulnerabilities to intercept text messages without touching your phone. Techniques such as eavesdropping, message redirection, and message injection can be carried out within the carrier network or during over-the-air transmission.

SMS codes are also vulnerable to phishing. If a user enters their username, password, and SMS code on a fake login page, attackers can capture all three in real time and immediately gain access the legitimate account.

Understanding SIM Swapping Attacks

One of the most dangerous threats to SMS-based security is the SIM swap. In SIM swapping attacks, a criminal contacts your mobile carrier pretending to be you and claims to have lost their phone. They then request the support staff to port your number to a new blank SIM card in their possession.

If they succeed, your phone goes offline, allowing them to receive all calls and SMS messages, including MFA codes for banking and email. Without knowing your password, they can quickly reset credentials and gain full access to your accounts.

This attack doesn’t depend on advanced hacking skills; instead, it exploits social engineering tactics against mobile carrier support staff, making it a low-tech method with high‑impact consequences.

Why Phishing-Resistant MFA Is the New Gold Standard

To prevent these attacks, it’s essential to remove the human element from authentication by using phishing-resistant MFA. This approach relies on secure cryptographic protocols that tie login attempts to specific domains.

One of the more prominent standards used for such authentication is Fast Identity Online 2 (FIDO2) open standard, that uses passkeys created using public key cryptography linking a specific device to a domain. Even if a user is tricked into clicking a phishing link, their authenticator application will not release the credentials because the domain does not match the specific record. 

The technology is also passwordless, which removes the threat of phishing attacks that capture credentials and one-time passwords (OTPs). Hackers are forced to target the endpoint device itself, which is far more difficult than deceiving users.

Implementing Hardware Security Keys

Perhaps one of the strongest phishing-resistant authentication solutions involves hardware security keys. Hardware security keys are physical devices resembling a USB drive, which can be plugged into a computer or tapped against a mobile device.

To log in, you simply insert the key into the computer or touch a button, and the key performs a cryptographic handshake with the service. This method is quite secure since there are no codes to type, and attackers can’t steal your key over the internet. Unless they physically steal the key from you, they cannot access your account.

Mobile Authentication Apps and Push Notifications

If physical keys are not feasible for your business, mobile authenticator apps such as Microsoft or Google Authenticator are a step up from SMS MFA. These apps generate codes locally on the device, eliminating the risk of SIM swapping or SMS interception since the codes are not sent over a cellular network.

Simple push notifications also carry risks. For example, attackers may flood a user’s phone with repeated login approval requests, causing “MFA fatigue,” where a frustrated or confused user taps “approve” just to stop the notifications. Modern authenticator apps address this with “number matching,” requiring the user to enter a number shown on their login screen into the app. This ensures the person approving the login is physically present at their computer.

Passkeys: The Future of Authentication

With passwords being routinely compromised, modern systems are embracing passkeys, which are digital credentials stored on a device and protected by biometrics such as fingerprint or Face ID. Passkeys are phishing-resistant and can be synchronized across your ecosystem, such as iCloud Keychain or Google Password Manager. They offer the security of a hardware key with the convenience of a device that you already carry. 

Passkeys reduce the workload for IT support, as there are no passwords to store, reset, or manage. They simplify the user experience while strengthening security.

Balancing Security With User Experience

Moving away from SMS-based MFA requires a cultural shift. Since users are already used to the universality and convenience of text messages, the introduction of physical keys and authenticator apps can trigger resistance. 

It’s important to explain the reasoning behind the change, highlighting the realities of SIM-swapping attacks and the value of the protected information. When users understand the risks, they are more likely to embrace the new measures.

While a phased rollout can help ease the transition for the general user base, phishing-resistant MFA should be mandatory for privileged accounts. Administrators and executives must not rely on SMS-based MFA.

The Costs of Inaction

Sticking with legacy MFA techniques is a ticking time bomb that gives a false sense of security. While it may satisfy compliance requirements, it leaves systems vulnerable to attacks and breaches, which can be both costly and embarrassing. 

Upgrading your authentication methods offers one of the highest returns on investment in cybersecurity. The cost of hardware keys or management software is minimal compared to the expense of incident response and data recovery.

Is your business ready to move beyond passwords and text codes? We specialize in deploying modern identity solutions that keep your data safe without frustrating your team. Reach out, and we’ll help you implement a secure and user-friendly authentication strategy.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.