In May 2026, Microsoft reported a multi-stage code of conduct-themed attack targeting users by directing them through several CAPTCHA and intermediate staging pages designed to reinforce legitimacy, allowing attackers to capture authentication tokens for immediate account access. The Microsoft Defender Research team observed a series of sophisticated phishing campaigns that targeted over 35,000 across more than 13,000 organizations, 19% of whom were in the healthcare and life sciences vertical.
Stolen session attacks have a broad blast radius since attackers can use them to open a victim’s email, SharePoint, and the sensitive information inside them. While the industry’s answer to account compromise has traditionally been deploying MFA, attackers have now found a way to bypass MFA and complete their objectives.
Security is a journey, not a destination. It works like a constant stair-step with new attack tactics emerging, defenders finding a way to detect or stop it, and attackers building their next technique around those new defenses. Attackers now assume most of the accounts they target are protected by MFA. Rather than always trying to beat it, they are increasingly trying to steal the result of it.
How Attackers Steal a Session
When a user logs into an application, the browser typically receives a session token or session cookie. That cookie is essentially proof that the user has already authenticated successfully. If an attacker steals it, they often do not need the password or MFA because the legitimate user has already completed both.
For example, a malicious actor might build a fake website that looks exactly like the victim’s bank’s login page and send them a phishing email. When the victims enter their credentials, the fake site passes them to the real bank, prompting it to forward a one-time MFA code. Then the attacker passes along the passcode, allowing them to sit in the middle of a legitimate login. When the user completes the session, the attacker still has access to the session cookie.
This technique is known as adversary-in-the-middle (AiTM) phishing, a newer name for man-in-the-middle. To the user, everything appears normal, but the attacker now holds a copy of that authenticated session.
Attackers know that session tokens expire, meaning that they essentially work against a countdown timer. Once they have a token, they move quickly, which can mean moving laterally, pulling sensitive information from SharePoint, or creating new accounts to maintain access. AI will likely help them move even faster.
Browser Extensions: A Quieter Way In
Phishing is not the only route to gaining access to session cookies. Because browsers store them, a malicious browser extension can watch for a new token and send it to the attacker the moment a user signs in. Session theft is not just an email security problem. It is an identity, endpoint, browser, and application security problem.
In June 2026, IBM researchers identified a malicious Chrome browser extension that sent session cookies to a remote server. The attacker manually monitored victim sessions live for approximately thirty seconds before deciding whether to activate the credential theft payload. The attack operates across four stages, beginning with a fake SSL certificate lure that installs the malicious chrome extension. From there, a beacon reports victim sessions to the operator who then steals passwords, one time passwords (OTPs), PIX key, and session cookies. Finally, a password field revealer strips masking from all input fields and prevents re-masking.
Today, the healthcare IT ecosystem contains a complex collection of applications, many of which run in browsers. Beyond worrying about the applications themselves, healthcare security teams must begin thinking about how these applications connect to their devices and how attackers can bypass MFA.
Why Security Awareness Has to Evolve
For roughly a decade, awareness training has taught employees to watch for typos, awkward phrasing, and logos that are not quite right. With AI, phishing emails are now well written and the branding is accurate. We trained users to examine the details, so attackers now spend extra time getting them right.
Awareness must now move beyond spotting mistakes and toward questioning context. Employees should ask why they are being asked to log in and whether the request was expected. We want them to be curious.
The safest habit is to go to an application directly rather than clicking an emailed login link. Because busy employees will continue to use links, organizations should avoid asking staff to click and sign in without advance notice.
Where MFA Fits Now
MFA still matters. Without MFA, stolen credentials can be sold in bulk on the dark web and used by anyone who buys them. Stealing a session token requires a far more targeted attack.
The misconception is believing any single control solves an entire category of risk, such as assuming MFA has solved identity. Attackers are smart, creative people, and they ask the same questions security teams ask, like what a compromised user would have access to.
For years, the firewall served as the perimeter. With Microsoft 365 and most business applications now in the cloud, the network perimeter has largely disappeared. Identity is the perimeter now. The session has become one of an attacker’s most valuable targets, and modern phishing is shifting from credential theft to trust theft.
Questions to Ask Your Security Team
A login can be legitimate while the session itself is compromised, so security cannot stop at authentication. No single indicator proves a compromise, but when several stack up, the story starts to tell itself. Leaders should be asking their teams:
• Would we spot a stolen session? Look for alerts on impossible travel, such as a login from home and another from London an hour later, along with unfamiliar locations, user agents, unmanaged devices, and unusual numbers of concurrent sessions.
• Do we watch what happens after login? Most people open Teams or email first. A user outside of IT who immediately creates accounts or searches SharePoint for passwords and financial files warrants a closer look.
• Can we revoke every active session quickly? Resetting a compromised user’s password is not enough, because the attacker can remain logged in until the stolen token expires. Revoking all active sessions should be standard in every response playbook.
• How long do our sessions last, and from what devices? Know how long sessions stay valid and whether unmanaged devices can reach critical applications.
• Where are we using phishing-resistant MFA? FIDO2 security keys and passkeys, which the Cybersecurity and Infrastructure Security Agency (CISA) recommends, make AiTM attacks much harder because authentication is cryptographically tied to the legitimate website.
• Do we know which browser extensions are running? Know which extensions are installed across the environment, including on shared clinical workstations, and who maintains them.
Defending against these attacks requires people who think like attackers, because you cannot detect an attack you do not understand. As I recently told a client, you want your SOC analyst to show up in a hoodie and your virtual CISO to show up in a suit.
For security leaders, the question should not stop at whether the organization uses MFA. The more important question is whether, if an attacker steals a valid session, the organization has the controls to detect it, contain it, and keep it from becoming a larger compromise. In healthcare, a hijacked session can reach the sensitive information and systems that patient care depends on.
Attackers have shifted their focus to the session. That is where identity security is heading, and it is where your defenses need to go next.
