Replayed session cookies bypassed the conditional access that blocked stolen passwords

The chain runs one direction. A browser-delivered infostealer takes the cookie, and Prophet Security says browser-delivered infostealers were the primary source of stolen sessions in the quarter ^[17]. The cookie gets replayed. The replay produces no authentication event, and conditional access evaluates at authentication, so no policy fires ^[10]. By Prophet's account the next checkpoint is the moment a refresh token is redeemed at the identity provider, which is also the only moment access can be re-evaluated or pulled ^[11].

That geometry explains the split in outcomes. Password-based attempts mostly lost: conditional access caught correct passwords arriving from commercial VPNs in new countries and from unfamiliar hosting providers, and phishing-resistant MFA stopped adversary-in-the-middle proxies that had already captured the credential ^[8].

Where credentials were phished rather than cookies stolen, the clock gave up the infrastructure. A sign-in from one country, an MFA approval from a second country sixteen seconds later, then 118 seconds on the retry ^[13]. Prophet reads that gap as a real-time proxy relaying the prompt, not a user in transit ^[13].

The arithmetic inside the identity figure is worth pulling apart. Identity was the target in roughly half of confirmed malicious activity ^[5], while direct attacks on accounts and sessions, the bucket holding session hijacking, token replay, MFA bypass, credential stuffing and inbox-rule or OAuth persistence, came to about 18% ^[7]. Subtract, and something near 32 points of identity-directed activity happened outside the sign-in page itself ^[20].

The same dataset argues against treating multifactor as finished. Push-approvable MFA fell to volume: one attacker sent repeated prompts from a residential proxy until the user accepted, and another combined brute force, lockout, automatic unlock and push bombing to enroll a new device ^[14]. Phishing-resistant factors were the control that worked against the relay proxies ^[8]. So the honest version of the session-controls case is narrower than "stop buying MFA": estates already on phishing-resistant factors have their remaining loss in session lifetime and revocation, and estates still approving pushes are losing at the front door.

Scope limits what this carries. One vendor, one customer estate, three months ^[1], and the percentages are shares of confirmed malicious activity rather than counts of victim organizations. Of completed investigations, 7% were confirmed malicious against 93% benign ^[3], about one in fourteen ^[21]. The findings rest on 4.7 million questions put to customer environments at a median of 35 per investigation ^[4], which puts the denominator somewhere near 134,000 investigations, an estimate only, because a median is not a mean ^[22]. Prophet says the full dataset sits in its first quarterly threat report ^[19]. No victim organizations are named, and there is no second telemetry set here to test the half against.

The supply line deserves more attention than the share. Infostealer activity touched roughly a quarter of the investigated organizations ^[16], delivered mostly through browsers rather than email, via compromised legitimate sites, malicious ads, sponsored search results, fake update prompts and ClickFix CAPTCHA gates that defeat automated sandboxing by requiring a human click ^[18]. Malicious code execution and tooling accounted for about 23% of confirmed malicious activity overall ^[15]. That is where the replayable sessions come from, and it is upstream of every control that only watches sign-ins.