Skip to content

Cybersecurity Atlasby Jer Catallo

Cybersecurity Atlas

One reference surface for application, cloud and product security.

API documentation

Find & Respond

AppSec Playbook
Vulnerabilities Atlas

Build & Harden

Hardening Atlas
Security Tooling

Learn the Fundamentals

Security Concepts

Resources

OWASP Top 10
MITRE ATT&CK
NIST Cybersecurity Framework

© 2026 Jer Catallo. Reference material only, always confirm against the official source.

About
API Documentation

Infostealer Session Token Theft incident response playbook · Cybersecurity Atlas

Home
Playbook
Infostealer Session Token Theft

Infostealer Session Token Theft

CriticalIdentity & AccessA07:2021 – Identification and Authentication Failures

Infostealer malware on an employee or customer device exports browser cookies, saved passwords, and tokens, letting attackers replay authenticated sessions and skip MFA entirely.

Immediate Response

1Revoke all sessions and refresh tokens for affected accounts.
2Reset passwords and re-register MFA from a clean device.
3Isolate and reimage the infected device.
4Review and undo actions taken with the stolen sessions, such as mailbox rules and OAuth grants.

Short-term Remediation

1Require managed, compliant devices for access to sensitive applications.
2Shorten session lifetimes for privileged and high-risk applications.
3Alert on token reuse from new IPs, networks, or device fingerprints.
4Block personal browser profile sync on corporate devices.

Long-term Prevention

1Bind sessions to devices where the platform supports it.
2Deploy EDR that detects credential and cookie theft from browsers.
3Use phishing-resistant MFA together with device trust signals.
4Monitor threat intelligence sources for leaked credentials and sessions.

Attack vectors

Cracked software, fake updates, and malicious ads that install infostealers
Personal or unmanaged devices used to sign in to work systems
Phishing attachments and malicious browser extensions
Stolen session logs bought from criminal marketplaces

Indicators of compromise

A session token reused from a new IP, network, or device without a new sign-in
Authenticated activity with no matching MFA event
New mailbox rules, OAuth grants, or API keys created right after unusual access
Your domains appearing in threat intelligence on infostealer logs

Tooling

EDRHave I Been PwnedSIEMIdentity provider sign-in logs

References

attack.mitre.org/techniques/T1539/
attack.mitre.org/techniques/T1555/003/