Client Advisories

Bay Geeks SOC Now Catches Session Hijacks Even When Attackers Hide Their Location

One of the more reliable signals a security platform has for catching a hijacked Microsoft 365 login is "impossible travel": if an account signs in from Tampa and then, twelve minutes later, signs in again from a location no one could physically reach in that time, something is wrong. It's a simple, effective check, and it's part of why account takeovers so often get caught within minutes.

It also has a known blind spot. Attackers increasingly route stolen session tokens through a VPN or anonymizer chosen to land in roughly the same city or region as the real user, so the two logins never look "impossible" to a distance-and-time check. We've closed that gap.

What's Changing

We've added AI-driven behavioral anomaly detection to the identity monitoring already running under Bay Geeks SOC, layered on top of (not replacing) the existing rule-based detection. Instead of relying only on where a login appears to originate, the platform now also looks at how a session behaves: the pattern of activity, device and application fingerprints, and other signals that don't line up with the account owner's normal behavior, even when the location looks unremarkable.

In validation testing, this caught the kind of session hijacking scenario security teams describe as a "zero-velocity" hijack: an attacker who never triggers an impossible-travel alert because they never appear to move.

Why Session Hijacking Is Worth Watching Closely

A stolen session token lets an attacker step into an account that's already signed in and already passed MFA, so they don't need a password or a one-time code to get in: they just reuse the session. It's a favorite technique in "adversary-in-the-middle" phishing kits precisely because it sidesteps multi-factor authentication rather than trying to defeat it head-on. Catching it depends on watching what happens after sign-in, not just what happens at the login screen, which is exactly the gap this update closes.

Common Questions

A note on how we build Bay Geeks SOC: Rather than building detection technology from scratch, we run Bay Geeks SOC on an established, vendor-agnostic MDR platform and back it with our own analysts and account ownership, so you get enterprise-grade detection engineering without the enterprise-grade price tag or a black-box vendor relationship. *Warranty terms & conditions apply. Ask us for details.

Microsoft Entra Passkey Enforcement: What's Actually Changing

If your business signs into Microsoft 365 using a text message or phone call for two-factor login, that method is being phased out by Microsoft on a specific timeline. This is not a rumor or a vague "someday" change: Microsoft has published exact dates. Here's what's confirmed, straight from Microsoft's own documentation.

What's Happening

Microsoft Entra ID (the sign-in service behind Microsoft 365) is retiring its built-in SMS and voice-call authentication methods. In their place, Microsoft is pushing passkeys, a phishing-resistant sign-in method tied to a device, biometric, or security key instead of a code sent by text or phone call.

This is a targeted change to one weak multi-factor authentication method, not a removal of passwords generally. If your organization already uses the Microsoft Authenticator app, a hardware key, or another MFA method, this change affects you less directly, but it's still worth reviewing who on your team still relies on SMS or voice codes.

After February 1, 2027, organizations that still want phone-based MFA can only get it by bringing their own service through a third-party telecom provider; Microsoft will no longer provide SMS/voice codes directly.

How Passkeys Work

A passkey is a cryptographic credential stored on a device (a phone, computer, or security key) instead of a password or a code sent over text. To sign in, a user confirms their identity with a fingerprint, face scan, or device PIN, and the device handles the cryptographic proof behind the scenes. Nothing that can be phished or intercepted ever gets typed or transmitted.

What You Need to Do

Common Questions

Resources

• Microsoft Learn: Passkeys by Default and Retirement of SMS/Voice Authentication
• Microsoft Learn: FAQ for SMS and Voice Retirement

Disclaimer: Rollout details can vary by tenant configuration and Microsoft may adjust dates. This bulletin reflects Microsoft's published documentation as of August 2026; verify current details at the Microsoft Learn links above, or contact Bay Geeks for guidance specific to your environment.