What is session-token theft?¶
Session-token theft happens when an attacker obtains the token that proves a user has already authenticated to a cloud service.
The attacker may then access the account without knowing the password or completing multi-factor authentication again.
What this means in practice¶
A session token may be stored in a browser cookie, application data or device memory. It can be stolen through malware, a compromised browser, malicious extensions, device access or interception of application data.
Once stolen, the token may allow the attacker to act as the user until it expires or is revoked. The activity can appear to come from a valid session because, from the provider’s perspective, the token is genuine.
A stolen token may also be used to create new persistence, such as trusted devices, delegated applications or additional accounts.
Containment may require explicit session and token revocation, not just a password change. Coordinate this with preservation because terminating sessions may remove access to live evidence.
What this does not show on its own¶
The dangerous assumption is that strong passwords and multi-factor authentication rule out account takeover.
The provider may record a new IP address, device or location using the existing session. But some services may not clearly distinguish that from normal session continuation.
What to do next¶
Look for activity that begins without a matching fresh login, especially where the user says they did not enter credentials or approve multi-factor authentication.
Compare session identifiers, token issue times, device records, IP addresses, browser information and later account changes. Check whether the suspicious activity continued after a password reset.
Key takeaway
Session-token theft allows access through a valid existing session, so investigate token use, session continuity and persistence rather than focusing only on passwords and fresh logins.