Beyond Passwords: Attackers Target Session Tokens to Bypass MFA
Cybercriminals are increasingly bypassing multi-factor authentication by stealing session tokens and cookies, shifting the focus of security from login to post-authentication activity.
The cybersecurity landscape is witnessing a significant shift in attacker tactics, moving away from traditional password theft towards the compromise of authenticated sessions. This evolution is rendering traditional defenses, such as password resets and even multi-factor authentication (MFA), less effective. Attackers are now prioritizing the theft of session tokens and cookies, which allow them to masquerade as legitimate users and maintain persistent access within trusted environments.
One prominent method enabling this shift is device code phishing. This technique exploits a legitimate sign-in process designed for devices with limited input capabilities. Threat actors trick users into entering a code from a phishing email into a genuine Microsoft or Google authentication page. By doing so, users unknowingly authorize the attacker's session, granting them account access even if MFA is enabled. The core issue is that these attacks target the authenticated session itself, not the initial credentials.
Traditional security measures, designed to detect stolen passwords, suspicious login attempts, or authentication failures, are proving inadequate. This is because attackers are operating with valid, albeit compromised, access tokens. They bypass the front-door security checks that organizations have heavily invested in, effectively walking through a checkpoint that has already been passed. As John Laliberte, CEO and Founder of ClearVector, notes, "From the perspective of the application, the adversary looks exactly like the legitimate user."
This pivot is largely driven by improvements in password security, including the widespread adoption of MFA and password managers, which have made direct credential compromise more challenging. Session tokens, once obtained, offer more persistent access and allow attackers to circumvent the password resets and MFA prompts that security teams typically monitor closely. Jasson Casey, CEO of Beyond Identity, observes, "As user authentication moves to device-bound passkeys that can't be copied, attackers simply move to the next-easiest target: the session token, which is still a copyable bearer credential almost everywhere."
The implication for defenders is profound: identity verification can no longer be treated as a one-time event. Security teams must shift their focus from securing the initial login to continuously validating trust throughout the entire session lifecycle. Shane Barney, CISO at Keeper Security, advises, "The most common mistake is assuming that successful authentication equals ongoing trust. Many organizations invest heavily in securing the login process but have limited visibility into what happens afterward."
Several factors contribute to this vulnerability. Persistent sessions, excessive user permissions, unmanaged third-party application integrations, and long-lived tokens create ample opportunities for attackers to operate undetected. Furthermore, identity sprawl across various cloud platforms, SaaS applications, and third-party services complicates the maintenance of consistent access controls.
To combat these evolving threats, organizations must implement robust post-authentication monitoring for anomalies. Limiting user privileges and third-party application permissions is crucial to minimize the impact of compromised sessions. Adopting phishing-resistant authentication methods like FIDO2 security keys and passkeys, and binding authentication tokens to trusted devices, can prevent token replay attacks. Continuous validation of user and device risk throughout a session, coupled with rapid revocation of compromised tokens, is essential.
Hayden Covington, associate director of security operations at Black Hills Information Security, emphasizes the need for continuous session validation. "The goal here is to monitor ongoing sessions for anomalies that suggest the person behind the session isn't the user who started it." Effective controls include phishing-resistant MFA, token protection that binds tokens to a device, and layered conditional access and session risk policies. Blocking unnecessary features like device code authentication and flagging abnormal device attributes can further strengthen defenses against these sophisticated attacks.