Cookie Bite Attack: Microsoft 365 Session Hijacking
The source describes the “Cookie Bite” attack, a novel method where malicious browser extensions steal authentication cookies like ESTSAUTH and ESTSAUTHPERSISTENT from users of Microsoft 365 and Azure Entra ID. By leveraging these cookies, attackers can bypass Multi-Factor Authentication (MFA) and hijack legitimate sessions, gaining unauthorized access to services like Outlook, Teams, and SharePoint. This attack is particularly dangerous because it operates within the browser and does not require system-level compromise, making it difficult to detect through traditional security measures. The article highlights the risks of this attack, including data exfiltration and internal impersonation, and outlines mitigation strategies such as monitoring risk-based sign-ins, implementing browser-level protections, and limiting session persistence. It also introduces Technijian’s security services as a solution to protect against this and similar threats.
The short version
“Cookie Bite” is an attack in which a malicious browser extension steals Microsoft 365 authentication cookies — specifically ESTSAUTH and ESTSAUTHPERSISTENT — and replays them to hijack a legitimate signed-in session across Microsoft 365 and Azure Entra ID.
Why it bypasses multi-factor authentication
MFA is checked when you sign in. Once that check passes, the session cookie is the proof that it already happened. An attacker holding a valid cookie arrives after the gate, so there is no second factor left to ask for. The account is not cracked; the session is borrowed.
What makes it hard to detect
- It lives in the browser. No malware is installed and the operating system is not compromised, so endpoint tooling looking for system-level changes may see nothing.
- The traffic looks legitimate, because it is a valid session token being used the way valid tokens are used.
- The delivery mechanism is a browser extension — software users often install themselves, outside any review process.
What an attacker gets
A hijacked session reaches whatever the user reaches: Outlook, Teams and SharePoint. The two consequences that matter most are data exfiltration, and internal impersonation — messages that genuinely originate from a trusted colleague’s account, which is exactly what makes internal phishing work.
Mitigations
- Monitor risk-based sign-ins. A session appearing from a new location or an implausible device is the signal that survives even when the token is valid.
- Apply browser-level protections and control which extensions can be installed. Extension allow-listing addresses the delivery route directly.
- Limit session persistence. Shorter session lifetimes reduce how long a stolen cookie stays useful.
What this means for your business
If your security posture assumes MFA settles the question of account security, this attack is the counter-example. MFA remains essential, but it protects the sign-in, not the session that follows. Extension governance and session lifetime are the controls that address what MFA cannot.
Technijian is an Irvine-based managed IT services provider working with businesses across Orange County and Southern California on Microsoft 365 security configuration.
