A session is what keeps you signed in between clicks. If an attacker gets hold of it, they skip the sign-in completely, including MFA.
Today most session hijacking in Microsoft 365 and Google Workspace happens through token theft: the attacker copies the session token and replays it from their own machine.
Common signs
- A session that jumps to a new country or device mid-use
- Activity while the person says they were offline
- Mail sent that the person did not write
How Centeye handles it
Centeye Gatewatch watches every sign-in and session across Microsoft 365 and Google Workspace and flags sessions replayed from the wrong machine.
Gatewatch: identity protection (ITDR) →Go deeper: Token theft in Microsoft 365