After someone signs in to Microsoft 365 or Google Workspace, their browser holds a token that says they already passed the password and MFA checks. Whoever holds that token is treated as them until it expires or is revoked.
Attackers steal tokens with fake login pages that relay the real sign-in (AiTM phishing), with malware that reads browser cookies, or by finding tokens left in scripts and files. Because MFA already happened, the stolen session skips it.
Common signs
- The same session used from two places or devices minutes apart
- New inbox rules that forward or hide mail
- A new MFA method or device added to the account
How Centeye handles it
Centeye Gatewatch spots stolen sessions replayed from someone else's machine, then ends every session and removes what the attacker added.
Gatewatch: identity protection (ITDR) →Go deeper: Token theft in Microsoft 365