BigBear 2.0: When MFA doesn't stop the attacker

If MFA is enabled, can your account still be stolen?

We have been tracking BigBear 2.0, a phishing operation using Evilginx2 to steal authenticated Microsoft 365 sessions.

The victim logs in, completes MFA, and everything looks normal. The attacker then steals the session and can use it to access the account.

Our investigation found 5,137 stolen records across the 461 organisations in 40+ countries.

It got us thinking: Are organizations paying enough attention to session theft, or are we still treating MFA as the finish line?

Curious to know how defenders here are approaching this.