The token is the new password
Most organizations aren't treating it like one
Why it matters
- Stolen session tokens can give attackers access even after users complete multifactor authentication
- Monitoring session activity can reveal compromises that successful login checks alone may miss
- Containment depends on quickly ending compromised sessions and verifying that access has stopped
Here’s the short version: token theft works because it happens after authentication.
That means multi-factor authentication (MFA) never even comes into play.
Once you’ve logged in, a small piece of data called a session token is what actually proves your identity to whatever application you’re using: your email, a work system, a bank. If an attacker gets hold of that token, they inherit your session without ever touching your password or your MFA prompt.
There’s always a token somewhere, and it’s what’s called a bearer credential: whoever holds it is trusted, no questions asked.
Why token theft has become so effective
What’s made token theft so operationally effective is that the tooling became cheap and easy to get. Attacking via token theft stopped requiring any special skill or targeting.
Infostealer malware pulls cookies and session tokens straight out of the browser and sells them on criminal markets. It can operate at volume, without targeting individual users. Get a device infected, and whatever tokens are sitting in the browser go up for sale.
Separately, adversary-in-the-middle phishing attacks quietly sit between you and the real login page, copying everything that passes through. They let the user complete MFA legitimately and grab the resulting session token in real time. The user does everything right, using the real password and completing the real MFA prompt, and still ends up compromised.
That's not a training failure. That's a gap in what the login process was ever designed to catch.
Where organizations underestimate the risk
Where organizations underestimate the risk is that they treat MFA as the finish line. They’ve hardened the login and stopped watching what happens after it.
Most detection is built around the authentication event, not session reuse. So a stolen token showing up from a new device, in a new location, mid-session often just looks like normal activity. It goes unnoticed. On top of that, tokens are frequently long-lived so people aren’t logging in every few minutes. When those tokens aren’t tied to a specific device, that gives an attacker a wide window to operate before anyone catches on.
MFA tells us who successfully logged in. It doesn’t tell us whether we should continue trusting that session five minutes later.
The way I’d frame it: we spent a decade hardening authentication, and attackers responded by skipping it entirely. The token has become the new password, but most organizations aren’t protecting or monitoring it like one.
What effective containment looks like
Detection and response speed are closely connected. Identity security can’t end at authentication. Trust has to be continuously evaluated throughout the session and, when that trust changes, organizations need the visibility and response speed to act immediately.
The organizations that contain these intrusions can disable an account, end its active sessions and rotate its credentials in minutes. The ones that end up with an enterprise-wide compromise often discover mid-incident that they disabled the account, but the stolen session token stays valid until it expires anyway.
That gap is often the whole ballgame. If the attack involves a stolen session, fast session revocation is essential to containment. Password resets and account lockouts alone may leave the attacker’s access intact.
And speed alone doesn’t happen by accident. The teams that can act on identity in minutes are the ones who’ve actually practiced doing it through tabletop exercises and regular validation. That preparation turns a response into muscle memory instead of improvisation. A playbook nobody has run under pressure tends to fail exactly when it matters most.
As with anything in security, if you don’t rehearse your worst day, it has a way of finding you.
The password was never really the finish line. It just used to look like one.
Key takeaways
- MFA strengthens authentication, but organizations must also protect and monitor the sessions established afterward
- Session theft can occur despite a completed MFA check; phishing-resistant authentication reduces exposure to common interception attacks
- Containment requires revoking compromised sessions and verifying that access has ended across affected applications
