What is token theft / pass-the-cookie?

Token theft is where an attacker steals an already-authenticated artifact — a web session cookie, OAuth token or Primary Refresh Token — and replays it to inherit the session without re-triggering MFA. Cookies are commonly harvested by infostealers or AiTM proxies (pass-the-cookie); cloud refresh tokens and PRTs extend access further. It maps to MITRE ATT&CK T1539, T1550.004 and T1528. Token binding, short token lifetimes, Continuous Access Evaluation and revoking sessions on incident are the key defences.

Token Theft: Replaying the Session Nobody Reset

Token theft (session hijacking) sidesteps passwords and MFA entirely by stealing an already-authenticated artifact and replaying it. Web session cookies are lifted from browser stores by infostealers or captured by AiTM proxies, then imported into an attacker’s browser (“pass-the-cookie”). In cloud and SaaS, OAuth access and refresh tokens are stolen and reused, and refresh tokens can be long-lived. On Entra-joined Windows, a local-admin attacker can extract the device-bound Primary Refresh Token (PRT) and mint single-sign-on tokens across Microsoft cloud. Because authentication already occurred, replay inherits the session without re-triggering MFA.

Three Flavours

Pass-the-cookie: a stolen web session cookie is replayed in the attacker’s browser. T1539 T1550.004
OAuth/refresh-token theft: cloud access and refresh tokens are reused for API and SaaS access; long-lived refresh tokens extend the window. T1528 T1550.001
PRT theft: on Entra-joined devices, a privileged attacker extracts the Primary Refresh Token and its session key to forge SSO tokens (analyst-mapped onto the token techniques above).

Infostealers are the dominant source of session cookies, feeding initial-access brokers and ransomware affiliates. MITRE’s own reporting cites Star Blizzard (Callisto/SEABORGIUM) using AiTM tooling to steal session cookies and bypass MFA on email accounts.

MITRE ATT&CK Mapping

Tactic	Technique	Usage
Credential Access	T1539 Steal Web Session Cookie	Cookie harvesting
Lateral Movement	T1550.004 Web Session Cookie	Pass-the-cookie replay
Credential Access	T1528 Steal Application Access Token	OAuth token theft
Defense Evasion / Lateral	T1550.001 Application Access Token	Token reuse

Detection & Mitigation

Deploy token protection / token binding (sender-constrained, device-bound sessions) so a stolen cookie or token is useless off the originating device; require device-compliant conditional access.
Shorten session and token lifetimes and enforce Continuous Access Evaluation (CAE) so revocation takes effect quickly.
Detect a token used from a new device, IP or ASN; impossible travel; and concurrent sessions with differing device or location details in sign-in logs.
On incident, revoke refresh tokens and sessions — not just reset passwords — and harden endpoints against the infostealers that harvest cookies.

Stop Session-Token Abuse

Mjolnir Security helps organisations bind sessions to devices and detect token replay.

Identity SecurityManaged Detection & ResponseEndpoint HardeningIncident ResponseThreat Hunting

Identity Security Review Enabling token protection, CAE and device-bound conditional access.
Managed Detection and Response Detecting token replay and impossible-travel sign-ins.
24/7 Incident Response Containment with full token revocation. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 12, 2026

Three Flavours

MITRE ATT&CK Mapping

Detection & Mitigation

Stop Session-Token Abuse

AiTM Phishing

OAuth Consent Phishing