Tag

#session-hijacking

1 post tagged #session-hijacking.

Analysis · Jul 5, 2026 · Colten Anderson

Nobody broke your MFA. They took the token it handed out.

Across four theft vectors and a half-dozen named campaigns, the pattern is the same: the session cookie, refresh token, or Entra PRT minted after MFA is the live credential, and the controls that guard the login don't guard the session.