Successful MFA Followed by Different Client Fingerprint

nomit vyas@xoxo

•updated Jun 25, 2026•3•0•13

Detects a successful authentication event (including MFA success) immediately followed by another successful authentication for the same user account from a different IP address or user agent, within a 10-minute window. This behavioral pattern is often indicative of session hijacking or adversary-in-the-middle (AiTM) phishing attacks where an attacker reuses a session token obtained from a victim.