pass-the-cookie attack

Pass-the-cookie attacks exploit session cookie hijacking to bypass multi-factor authentication (MFA) systems, including those used by Microsoft 365 and YouTube. Recent advisories from the FBI and cybersecurity firms highlight the growing threat, where attackers steal authentication cookies after MFA is completed, gaining persistent access without needing credentials. This tag covers discussions on how pass-the-cookie attacks work, real-world impact, and critical mitigations such as enforcing short session timeouts, using token binding, and monitoring for anomalous cookie usage. Organizations and individuals can strengthen defenses by implementing these measures to protect against session hijacking even when MFA is active.