in one lineToken theft steals the proof of a finished login, so the attacker arrives already authenticated, MFA included.
the numbers
- 39,000token theft incidents every dayMicrosoft Digital Defense Report, 2024
- +84%yearly growth in emails carrying infostealersIBM X-Force Threat Intelligence Index, 2025
- 99.2%of account-compromise attacks are blocked by MFAMicrosoft, 2023
1what it is
When a login completes, the service issues a session token, a cookie or credential the browser presents on every subsequent request so the user is not re-challenged each click. The token embodies the whole finished authentication, second factor included.
Token theft takes that artifact instead of the password. Two routes dominate. Adversary-in-the-middle (AiTM) phishing puts a relay page between the user and the real login: the victim signs in genuinely, MFA prompt and all, and the kit captures the resulting session cookie. Infostealer malware takes the other path, harvesting tokens already sitting in the browser. Either way, the attacker replays the token and arrives authenticated. Nothing was cracked, and "bypass" is the accurate word: the kit relays a legitimate login and steals its output.
2why it accumulates
Token theft scaled because MFA worked. As second factors closed the stolen-password route, the criminal ecosystem industrialized the next layer: phishing kits like Tycoon2FA, which Microsoft documented in 2026 as a leading AiTM operation run at scale, sell the relay as a service, and infostealer logs are bulk commodities. Microsoft's Digital Defense Report 2024 estimated around 39,000 token theft incidents per day and a 146% year-over-year rise in AiTM phishing, and IBM X-Force measured an 84% yearly jump in emails delivering infostealers.
Long session lifetimes make every stolen token more valuable, and they are long by default because re-authentication annoys users.
3what it costs you
A replayed token defeats the control your security case leans on. The credential numbers frame the stakes: stolen credentials figured in 36% of breaches (Verizon, 2026), and half of ransomware victims had credentials leak in the 95 days before the attack. Tokens are credentials in their most finished form: no password to crack, no MFA to trigger, often no alert at all, because the activity rides an existing valid session.
For a mid-market company the practical consequence is mailbox and SaaS takeover that looks like the user: payment fraud run from the real finance mailbox, OAuth grants approved by the "user" to persist access, data pulled at session speed.
what it looks like when it goes wrong
Three ways this tends to go, each one taken from a real case.
- it happenedReddit, 2023howA fake login page passes the password and code to the real site as they are typed.what leavesinternal documents, code and dashboardswho ends up with itthe attacker behind the page
- it happenedUber, 2022howLogin prompts keep coming until a tired employee taps approve.what leavesadmin tools and company chatwho ends up with itan attacker who bought a contractor's password
- it happenedRetool, 2023howA caller posing as IT gets one code, and synced codes unlock the rest.what leavescustomer accounts and fundswho ends up with itthieves
4what works
The control that changes the economics is phishing-resistant authentication. FIDO2 keys and passkeys bind the login to the genuine domain, so a relay page captures nothing usable; the AiTM kit simply has nothing to steal. The accounts worth moving first are the ones a stolen session monetizes fastest, admins and finance, with coverage widening from there.
Token value is the other lever. Tighter session lifetimes and re-authentication for sensitive actions cap the replay window, and conditional access that binds sessions to device and location makes a replayed token conspicuous rather than invisible. On the infostealer side, the exposure is tokens sitting in browsers on unmanaged machines, so device requirements for company sessions and basic browser sign-in hygiene shrink the harvest directly.
Revocation deserves rehearsal before it's needed. The console action that kills a user's sessions everywhere is worth knowing today rather than mid-incident, because disabling the account without revoking its sessions leaves the attacker logged in on the token that still works.
A stolen session that persists leaves fingerprints in the directory: new OAuth grants, freshly created mail-forwarding rules, changed MFA methods. Each is how a one-time theft becomes standing access, and each is visible to anyone who looks. Real-time detection of a theft in progress belongs to ITDR tooling, but the posture work above decides something detection never can: how much of the estate a single stolen session is able to reach.
on the record
your turn
what you can do about it
this week
Check which second factor your admins use, and whether it can be relayed by a fake login page.
Phishing-resistant factors stop most session theft.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →