Session Tokens Are the Real Target

For most of the past decade, security advice on credential attacks reduced to a single instruction. Turn on multi-factor authentication.

That instruction was correct and it worked, which is precisely why attackers stopped attacking the thing it protects.

The current generation of credential campaigns does not try to defeat MFA. It waits for the victim to complete it, then steals what the authentication produced. The password was never the prize. The session was.

What the Frameworks Actually Describe

This is documented rather than speculative, which matters when assessing how much of it is vendor narrative.

MITRE catalogs the technique as T1539, steal web session cookie, describing how an adversary may steal web application or service session cookies and use them to gain access as an authenticated user without needing credentials.

Two details in that entry do the real work. Session cookies are issued after authentication completes, including MFA. And cookies are often valid for an extended period even when the application is not actively used.

The entry also notes that session cookies can be used to bypass some multi-factor authentication protocols, and that open source frameworks exist to gather session cookies through a malicious proxy in phishing campaigns.

The delivery mechanism is a separate catalogued technique. Adversary-in-the-middle is T1557, and the two are routinely chained: proxy the login, let the victim authenticate legitimately, capture the resulting cookie.

From the identity provider's perspective, nothing anomalous occurred. A valid user completed a valid authentication with a valid second factor.

Why B2B CIAM Environments Are Harder to Defend

The problem compounds in multi-tenant business applications, where a single stolen session can carry organizational scope rather than individual scope.

Ory documents its approach to multi-tenant identity with organization-level isolation, and in any b2b ciam deployment the governing question after a session compromise is what that session was authorized to reach, because a token scoped to an entire tenant is a different incident from one scoped to a single user.

That is an architectural decision made long before any attack, and it determines blast radius rather than likelihood.

Three design choices matter disproportionately.

Token lifetime. RFC 6749 establishes that an access token denotes specific scope, lifetime and access attributes. A long lifetime is convenient and it is also the window an attacker operates in.

Scope granularity. A token that grants everything the user could ever do grants everything to whoever holds it.

Binding. Whether the token is usable from any device or only the one it was issued to.

What Actually Reduces Risk

The evidence points consistently in one direction, and it is not more prompts.

CISA's advisory on Scattered Spider recommends implementing FIDO/WebAuthn authentication or PKI-based MFA, stating plainly that these implementations are resistant to phishing and not susceptible to push bombing or SIM swap attacks, both techniques attributed to that actor.

The mechanism is origin binding. A FIDO credential produces a signature valid only for the domain it was registered against, so a proxy sitting on a lookalike domain receives a signature the real service will reject. The interception step fails before a session exists to steal.

That is a protocol-level defense rather than a behavioral one, which is why it holds where user training does not.

Federal guidance reinforces the redundancy point. The Phishing-Resistant Authenticator Playbook advises agencies to identify and implement at least two phishing-resistant options, noting that FIDO is implemented through vendor software that could itself be susceptible to vulnerabilities, and citing a 2023 case where a patch to Microsoft PKI validation software broke PIV authentication.

A single phishing-resistant method is a single point of failure.

Beyond authentication itself, the controls that matter operate after the session exists.

Device binding. A stolen cookie replayed from unmanaged infrastructure fails a device check regardless of how it was obtained.

Short session lifetimes for privileged scopes. Inconvenient, and it directly shrinks the attacker's window.

Post-authentication monitoring. Impossible geolocation, user agent changes mid-session, sudden privilege escalation. The login looked clean, so detection has to happen afterward.

Blocking legacy authentication paths that bypass modern conditional access entirely.

What Only Adds Friction

Worth naming, because security budgets are finite and some controls buy nothing against this class of attack.

Push notification MFA is defeated by a proxy that simply waits for approval. MITRE catalogs the fatigue variant separately as MFA request generation.

SMS one-time codes are interceptable, SIM-swappable and, critically, still produce a session the attacker can capture regardless.

Forced password rotation has no bearing on a technique that does not require the password.

Security awareness training on spotting fake login pages helps marginally against a pixel-accurate proxy of the real page. The user is looking at a real login flow, because it is one.

None of those are worthless in general. Against session theft specifically, they are close to it.

The Shift in Where the Perimeter Sits

The practical conclusion for most organizations is that identity has become the boundary, and the boundary is no longer the login event.

It is every request carrying a token afterward.

Cookie configuration is part of that surface. MDN documents that SameSite=None requires the Secure attribute or browsers reject the cookie, and that Secure cookies are transmitted only over HTTPS.

Defenses built entirely around the moment of authentication assume the session is trustworthy once issued. The documented techniques assume the opposite, and they are currently winning on that assumption.

Deploy origin-bound authentication, keep two phishing-resistant options, bind sessions to devices, shorten privileged lifetimes, and monitor what happens after the green tick. That combination addresses the attack that is actually occurring rather than the one MFA was designed for.