For years, the cybersecurity conversation has centred on passwords. Use a strong one. Don’t reuse it. Add multi-factor authentication. It became the standard advice, repeated in boardrooms and IT policies across the world.
It is still good advice. But attackers have largely moved past it.
A shift has been quietly accelerating; rather than stealing your password, attackers are increasingly stealing the session token that proves you already logged in. And that changes the risk picture in ways many organisations have not fully reckoned with.
What Is a Session Token and Why Does It Matter?
When you log in to a web application, your browser and the server exchange a token that essentially says, “this person already authenticated, let them through.” That token is what keeps you logged into your banking app, your cloud storage, or your company’s Microsoft 365 environment without making you re-enter your credentials on every click.
The problem is that token functions like a physical key. Whoever holds it gets in, no questions asked. As one security researcher put it, the token represents proof that authentication already happened, so the system sees no reason to challenge it again.
That means MFA is bypassed entirely. Not cracked. Not defeated. Simply skipped.
The Numbers Are Hard to Ignore
Session hijacking has seen a 127% year-on-year increase in 2026, making it one of the fastest-growing attack vectors right now. Infostealers, the malware specifically designed to quietly harvest browser cookies and session tokens from infected devices, have become one of the most commercially active malware categories on the market. One recently discovered infostealer-as-a-service operation was advertising 24/7 customer support and tools simple enough, in the operator’s own words, “that even a child can figure it out.”
SpyCloud recovered over 642 million exposed credentials from more than 13 million infostealer infections in 2025 alone. Many of those were not just passwords. They were active sessions.
Why African Organisations Are Exposed
The shift to cloud-based work has expanded the attack surface considerably. Microsoft 365, Google Workspace, banking portals, ERP systems, and remote access tools all rely on session-based authentication. In South Africa and across the continent, accelerated digital adoption means more employees accessing more services through more devices, often without the endpoint visibility needed to detect an infostealer infection early.
A single compromised laptop in a finance team or IT department can expose authenticated sessions to cloud infrastructure, payroll systems, and administrative tools. The attacker does not need to phish anyone again. They already have the key.
What Good Defence Looks Like Now
MFA is still worth having. But it cannot be the finish line. Organisations need to go further:
- Monitor for anomalous session behaviour, logins from unusual locations or devices, even when authentication succeeds
- Shorten session token lifespans and enforce re-authentication for sensitive actions
- Invest in endpoint detection capable of identifying infostealer activity before tokens are exfiltrated
- Consider phishing-resistant authentication methods like passkeys, which bind authentication to a specific device and make session hijacking significantly harder
The threat has evolved. The defence needs to keep pace.
Knowing your password is strong is no longer enough. The question worth asking today is: if someone already has your session, would you know?
