Infostealers and Stolen Session Cookies: How Attackers Walk Past Your MFA Without Touching It

The font pack, the personal laptop and the client Drive

A designer at a 20-person marketing agency needs a specific display font for a pitch on Sunday night. The foundry wants 200 dollars for the family. A forum post offers the whole thing free, in a zip file, with instructions to disable the antivirus "because of a false positive." He is working from his own laptop, which is also where his company Google Workspace is signed in, because the agency never got around to buying him one.

The fonts install fine. The pitch goes well.

Three weeks later the account manager gets a call from the agency's largest client. A competitor has just quoted the exact numbers from a confidential proposal. The client's own security team traced the file to a download from the agency's shared Drive, made at 3:40 a.m. local time from an address in a country where the agency has never had a single employee.

The owner's first reaction is the one everybody has: "That is impossible. We have MFA on everything." She is right about the MFA. She is wrong about what it protects. The attacker never logged in. He simply picked up the designer's browser session, which was still open, and walked through the door the designer had left ajar from his own sofa.

What the heck does this mean

An infostealer is malware built for one job: copy everything useful from a computer and send it home. It is not interested in encrypting your files. It wants the saved passwords in the browser, the autofill data, the crypto wallet extensions, and above all the session cookies.

A session cookie is the small token a website gives your browser after you sign in so that you do not have to sign in again on every page. It is proof you already passed the login, including MFA. Steal the cookie, and you inherit that proof.

Session hijacking is using that stolen cookie from another machine. The service sees a valid session. No password prompt. No MFA prompt. Nothing to alert on, unless somebody is watching where the session comes from.

Stealer logs are the packaged output, sold in bulk on criminal markets. Ransomware crews buy them the way a burglar buys a list of houses where the back door is open.

The connection owners miss: the stealer runs on one device, usually the one the company does not manage. The damage lands on the company's cloud accounts.

The numbers that matter

Half of ransomware victims, 50%, had a credential or infostealer event in the 95 days before the attack, according to the Verizon 2026 Data Breach Investigations Report. The stealer is the scout. The ransomware is the army that follows.

Infostealers infected 24.8 million unique devices in 2025 and harvested 2.3 billion passwords, per the Constella 2026 Identity Breach Report. Somewhere in those logs are passwords that still work at businesses that have no idea.

Sophos found in its 2026 frontline analysis of 661 incident response and MDR cases that 67% of root causes were identity-related, and MFA was missing where it mattered in 59% of them. Missing MFA is the first problem. A stolen session that walks past working MFA is the second.

What to do this week

1. Put endpoint detection on every device that touches company accounts, and if a device cannot have it, that device does not get company accounts. The cracked font pack would have been caught the moment it tried to read the browser's password store. (CIS 10 Malware Defenses)
2. Turn off password saving in the browser for company profiles and move everyone to a password manager. Browser password stores are the first thing a stealer opens. (CIS 4 Secure Configuration of Enterprise Assets and Software)
3. Shorten session lifetimes on your cloud platform and require re-authentication for admin actions. A cookie that expires in eight hours is worth far less than one that lasts a month. (CIS 5 Account Management)
4. Block software installation by ordinary users on company machines. Nobody needs to disable antivirus to install a font. (CIS 4 Secure Configuration of Enterprise Assets and Software)
5. Review sign-in logs for your cloud tenant once a week, filtered by country. Five minutes. The 3:40 a.m. download had a country attached to it. (CIS 5 Account Management)
6. Decide the personal-device question. Either issue company laptops, or write the conditions under which a personal one is allowed and enforce them with a device check at sign-in. (CIS 1 Inventory and Control of Enterprise Assets)

Where AccuSights fits

Our assessment looks at the devices and sessions your cloud accounts trust, beyond whether MFA is switched on: the personal laptop with admin access, the 30-day session that never expires, the browser full of saved passwords. Start with the Cyber Hygiene Test, three minutes, then spend 15 minutes with an engineer on what the findings mean.

Questions people ask

Can hackers get in even with MFA on? Yes, if they have your session cookie. MFA runs at sign-in. After that, the website hands your browser a token that says this session is already verified, and it keeps saying so for days or weeks. An infostealer copies that token and replays it from another machine. The service sees a valid session and asks no questions. Shorter session lifetimes and device-bound sign-in are the fixes.

Should staff use personal laptops for work email? Not if you can avoid it, and not without conditions if you cannot. A personal laptop has whatever the family installed on it, and the company has no way to see or update it. If staff must use their own machines, require a separate browser profile for work, current updates, endpoint protection you can verify, and no saved passwords in the browser. Better still, issue a company device and keep the company accounts on it.

How do I know if my passwords are in an infostealer log? Some identity-monitoring services and breach-notification tools index recovered stealer logs and will alert you when a company email address appears. Watch also for the practical signs: sign-ins from countries where you have no staff, MFA prompts nobody requested, and new mailbox rules. If any of those appears, reset the password, revoke every active session for that account, and check the device it was used on.

MFA locks the front door. The infostealer never uses the front door. It climbs in through the window you left open on the sofa.