T1550.004 (Web Session Cookie)

NovaCookies rents real-time Microsoft 365 session theft for $320 a month

Island says the adversary-in-the-middle service runs on at least 755 domains against hundreds of organizations. The session it steals arrives after an authentication the identity provider records as entirely normal.