# pass-the-cookie

Source: https://startwithidentity.com/glossary/pass-the-cookie/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

Pass-the-cookie is an attack in which a stolen, already-authenticated web session cookie is imported into the attacker's browser to take over the session, bypassing the password and MFA entirely; MITRE ATT&CK tracks the replay as [T1550.004, Web Session Cookie](https://attack.mitre.org/techniques/T1550/004/) and the theft as [T1539, Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/).

Cookies are bearer credentials: whoever presents one is the user, for as long as the session lives. Infostealer malware harvests them in bulk from browser profiles, and adversary-in-the-middle phishing kits capture them in real time during a genuine MFA login, which is why phishing-resistant MFA alone does not stop the infostealer path. Defenses work on the session rather than the login: shorter sessions for sensitive apps, re-evaluation through signals such as CAEP, binding the session to a device key so a copied cookie fails elsewhere, which is what Chrome's [Device Bound Session Credentials](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials) does, and revoking sessions, not just resetting passwords, after an infection.

See also: [session cookie theft](https://startwithidentity.com/techniques/session-cookie-theft/), [session hijacking](https://startwithidentity.com/glossary/session-hijacking/), [Device Bound Session Credentials](https://startwithidentity.com/glossary/device-bound-session-credentials/), [infostealer](https://startwithidentity.com/glossary/infostealer/), [token theft](https://startwithidentity.com/glossary/token-theft/), [AiTM phishing proxy](https://startwithidentity.com/techniques/aitm-phishing-proxy/), [CAEP](https://startwithidentity.com/glossary/caep/)