After sign-in, applications use session tokens to recognize a user. If an attacker steals or abuses a valid token, they may access the account without knowing the password.
Key takeaways
What to know before you act
- After sign-in, applications use a session token or cookie; an attacker who steals it may be able to act as the user without the password or MFA.
- Information-stealing malware and adversary-in-the-middle phishing pages are common ways tokens are stolen today.
- Defenses include device health checks, conditional access, shorter session lifetimes for sensitive access, and the ability to revoke sessions quickly.
Why it matters
What business leaders should understand
MFA is essential but may not stop every session-theft technique. Device security, phishing resistance, conditional access, application design, and rapid token revocation matter.
The right response should reflect your environment, data, vendors, risk, and operational priorities. Use this guide as a practical starting point, then validate important decisions with the people responsible for your technology, cybersecurity, legal obligations, and insurance coverage.
Learn how Meta IT Pro can help with cybersecurity services and security awareness training.
Related reading: What is a phishing attack? and What is malware?.
How session hijacking bypasses passwords and MFA
When you sign in to a cloud service, the application issues a token so you do not have to authenticate on every click. That token represents a session that has already passed MFA. If an attacker copies it, they may be able to reuse the session from another device.
Tokens can be stolen by malware that harvests browser cookies, by phishing sites that relay the real sign-in page and capture the resulting session, or by insecure applications. Because the attacker never needs the password, a password reset alone may not end their access.
Reducing the risk
Protection works at three points: keep devices from being infected, make stolen tokens harder to reuse, and respond quickly when theft is suspected.
- Use endpoint protection to detect information-stealing malware.
- Prefer phishing-resistant MFA, such as passkeys or security keys, where supported.
- Apply conditional access that considers device compliance and sign-in risk.
- Shorten session lifetimes for administrators and sensitive applications.
- Discourage saving work sessions in personal browsers or unmanaged devices.
Responding to suspected token theft
Revoke the user's active sessions and refresh tokens, reset the password, and review sign-in logs, mailbox rules, OAuth app consents, and recent file activity. Investigate the device the token came from, since malware may still be present.
Practical action plan
Steps your business can take
Use HTTPS everywhere and secure session-cookie settings in business applications.
Protect endpoints and browsers against credential and token-stealing malware.
Apply conditional access, device compliance, short-lived sessions, and risk-based controls where appropriate.
Revoke active sessions and investigate devices after suspected account compromise.
Recommended next steps
Continue from this article.
These pages expand the specific risks and decisions covered in this guide. Use them to move from general understanding to the service, tool, or related topic that best matches your next question.
Related guide
What is a phishing attack?
Recognize the fake sign-in pages that capture passwords and sessions.
Explore nextRelated guide
What is malware?
Understand information stealers that harvest browser cookies and tokens.
Explore nextService
Microsoft 365 management & security
Apply conditional access and session controls to cloud accounts.
Explore nextService
Incident response services
Revoke sessions and investigate suspected account takeover.
Explore nextWarning signs
Do not ignore these indicators
- Account activity continues after a password change
- Sign-ins originate from unusual devices or locations without a normal login event
- Browser extensions or malware detections suggest token theft
Frequently asked questions
Common questions, answered.
Can session hijacking bypass MFA?
Yes. If an attacker steals a session token created after MFA, they may reuse it without the password or MFA.
How are session tokens stolen?
Commonly through information-stealing malware or phishing pages that relay the real sign-in and capture the session.
What should we do after suspected token theft?
Revoke sessions, reset the password, review sign-in logs and mailbox rules, and investigate the device involved.
How Meta IT Pro can help
Related services and practical next steps
Explore the services connected to this topic. These links provide more detail about scope, safeguards, support, and how to start a conversation with our team.
Authoritative references
Sources and further reading
These primary sources support the guidance in this article and provide additional technical or consumer information.
OWASP Foundation
Session Management Cheat Sheet
Guidance on securely creating, protecting, and expiring application sessions.
Microsoft Learn
Token theft playbook
Microsoft guidance for investigating and responding to token theft in Microsoft Entra ID.
National Institute of Standards and Technology
NIST SP 800-61 Rev. 3: Incident Response Recommendations
Current NIST guidance for integrating incident response into cybersecurity risk management.
Need help with your IT solution?
Get practical guidance from a local IT and cybersecurity team.
Meta IT Pro helps Massachusetts and Rhode Island businesses improve support, security, Microsoft 365, Google Workspace, networks, backup, recovery, and compliance readiness. Tell us what is not working - or what you want to improve - and we will help identify a sensible next step.