Pass-the-Cookie
Pass-the-cookie is an attack in which a stolen, already-authenticated web session cookie is imported into the attacker's browser to take over the session, bypassing the password and MFA entirely; MITRE ATT&CK tracks the replay as T1550.004, Web Session Cookie and the theft as T1539, Steal Web Session Cookie.
Cookies are bearer credentials: whoever presents one is the user, for as long as the session lives. Infostealer malware harvests them in bulk from browser profiles, and adversary-in-the-middle phishing kits capture them in real time during a genuine MFA login, which is why phishing-resistant MFA alone does not stop the infostealer path. Defenses work on the session rather than the login: shorter sessions for sensitive apps, re-evaluation through signals such as CAEP, binding the session to a device key so a copied cookie fails elsewhere, which is what Chrome's Device Bound Session Credentials does, and revoking sessions, not just resetting passwords, after an infection.
See also: session cookie theft, session hijacking, Device Bound Session Credentials, infostealer, token theft, AiTM phishing proxy, CAEP
Related on Start with Identity
- GlossaryAdversary-in-the-Middle (AitM)
Adversary-in-the-middle (AitM, written AiTM by MITRE) is an attack in which the attacker positions itself between two parties, such as a user and a sign-in serv
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- GlossaryConsent Phishing (Illicit Consent Grant)
Consent phishing, which Microsoft calls an [illicit consent grant](https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-illicit-consent-gr
- BlogPass-the-Passkey: a Black Hat researcher found the WebAuthn implementation bugs, not the standard
At Black Hat USA 2026, SpecterOps principal security researcher Michael Grafnetter presented a family of passkey attacks including cleartext YubiKey signatures
- VendorProton Pass
strong