Most people understand account compromise as someone learning their password. A significant share of real compromises skip that entirely: the attacker obtains the token that proves you already logged in, and presents it.

How tokens are obtained

  • Infostealer malware harvesting browser cookies from an infected machine.
  • Real-time phishing proxies that sit between you and the genuine site, capturing the session as it is created.
  • Cross-site scripting on a vulnerable site, reading tokens accessible to JavaScript.
  • Tokens leaked through logs, URLs, or third-party scripts with page access.

Why multi-factor authentication does not stop it

MFA is evaluated during authentication. A stolen session token represents the result of a completed authentication, so replaying it never triggers a second factor. This is why account takeovers occur on accounts with MFA enabled, and why the correct response to suspected compromise includes revoking sessions rather than only resetting the password.

What to do if you suspect it

From a clean device: change the password, then explicitly sign out of all sessions and devices — most major services offer this, frequently buried in security settings. Then review connected applications and authorised tokens, which persist independently. If malware is suspected, rebuild the device before signing back in, or you will simply hand over a fresh session.

For site owners

  • Set cookies HttpOnly, Secure, and SameSite to limit theft and cross-site use.
  • Rotate the session identifier on login and on any privilege change.
  • Keep sessions reasonably short for sensitive applications, with re-authentication before high-risk actions.
  • Bind sessions loosely to context and flag abrupt changes in address or device fingerprint.
  • Provide users a visible session list with one-click revocation.

The design principle

Assume tokens will occasionally be stolen and design so that theft has a short useful life and limited reach. Re-authentication before consequential actions — changing payment details, exporting data, adding administrators — converts a stolen session from a full compromise into a limited one.