standard

Device Bound Session Credentials

Web specification that binds a browser session to a private key held on the device, so an exfiltrated cookie cannot be replayed from another machine.

Known aliases

DBSC

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 publisher

Stealer logs now carry AI session tokens that replay straight past MFA

Okta's read of one Telegram stealer dump shows commodity malware now hoovering up AI session tokens and API keys, and a replayed token walks past MFA because the second factor was spent when the token was minted.

Publishers:thehackernews.com

Reality

Evidence61
Adoption56
Hype gap+16
Incentives71
Confidence57