You did everything right. Long password, unique to that account, multifactor authentication turned on. Then one morning your accounting platform shows a login from another state, and nobody at your bank can explain how, because your password was never used and no code was ever sent to your phone.
That is session theft, and it is one of the least understood problems in small business security. It sidesteps the front door entirely. Understanding it takes about five minutes, and once it clicks, a handful of settings you have probably been ignoring suddenly look very important. Let us walk through it.
The Hotel Key Card Explains Everything
Picture checking into a hotel. You walk up to the front desk, show your ID, hand over a credit card, maybe answer a question to confirm you are who you say you are. That is the login. Then the clerk hands you a plastic key card and you never have to do any of that again for the rest of the week. You just tap the card and the door opens.
Now suppose you drop that card in the parking lot and somebody picks it up. That person cannot answer a single question about you. No ID, no credit card, no idea what room you are in. It does not matter. The door does not ask questions. The door just reads the card.
That is precisely what a session is. When you sign into a system and it stops asking you to log in every few minutes, it is because the site handed your browser a token: a small piece of data that means “this person already proved who they are, let them through.” Microsoft’s identity engineering team described this directly in a 2024 post on breaking the token theft attack chain, noting that a stolen token lets an attacker impersonate a legitimate user and reach protected resources without needing the original credentials. The token is the key card. Whoever holds it is you.
Why Your MFA Did Not Stop It
This is where owners get frustrated, and fairly so. You paid for multifactor authentication. You made everyone set it up. Then it did not fire.
The reason is simple once you see it. Multifactor authentication is a check at the front desk. It happens at the moment of login. A stolen session token is used after the login already succeeded, so there is no login for MFA to interrupt. Microsoft’s 2024 guidance makes the same point: because the token is taken after authentication, it circumvents standard multifactor authentication, since the attacker already holds valid proof of a completed session.
Tokens get taken a few different ways, and you do not need the mechanics to defend against them. What you need to know is the shape of the problem:
- Malware on the device. Software that collects browser data grabs session cookies right alongside saved passwords. In a joint advisory published in 2025, the FBI and CISA documented an information stealing malware family that harvests exactly this kind of browser data from infected machines.
- Convincing fake login pages that sit in the middle. The user is looking at a page that relays their real login to the real site, and the resulting session lands in the wrong hands. CISA has warned that some forms of MFA are vulnerable to phishing, push bombing, and other attacks, and that not all forms of MFA are equally secure.
- Shared or borrowed devices. A staff member signs into email on a family computer or a hotel business center and never signs out. That session lives on without them.
- Sessions that simply never expire. Plenty of business platforms keep you signed in for months by default. That is a very long time for a key card to stay valid.
What Defense Looks Like in Practice
The good news is that the fixes are mostly configuration, not spending. Here is the list, in the order we usually tackle it for a client.
- Sign out of everything after any incident. This is the one people skip. Resetting a password does not automatically invalidate existing sessions on most platforms. You have to explicitly revoke them, using the control usually found in the security or active sessions area of the account settings. If you take one action from this article, make it this one.
- Shorten session lifetimes on the systems that matter. Banking, payroll, accounting, and administrator accounts do not need to stay signed in for ninety days. Microsoft’s 2024 token theft guidance lists shorter session lifetimes as a core defense, because a shorter window means a stolen token is more often already dead by the time somebody tries it.
- Move to phishing resistant, device bound login. CISA strongly urges organizations to implement phishing resistant multifactor authentication and calls it the gold standard, pointing to FIDO and WebAuthn based methods that use public key cryptography. In practice that means hardware security keys and passkeys. We broke down the differences in YubiKey vs passkey vs MFA, and if you are new to the hardware side, start with what a YubiKey actually is.
- Bind sessions to known devices. Microsoft’s 2024 guidance recommends token protection and device binding, which ties a session to the specific machine it was issued to. A key card that only works in the hand that received it is a dramatically less useful thing to steal.
- Add conditional access rules. These are rules that look at context before granting access: is this a company managed device, is this a country we operate in, is this login pattern normal. Most business email and productivity platforms include some version of this. It is one of the highest value features small businesses already own and never enable.
- Protect the endpoint. If the laptop is compromised, the session was never safe to begin with. Real endpoint detection with somebody actually reviewing alerts is the foundation everything else sits on.
The Incident Response Habit Worth Building
Most small businesses have an unwritten response to a suspected compromise, and it is two steps: change the password, and hope. That leaves the door open.
Write down a longer version and tape it inside a cabinet. When something looks wrong on an account: reset the password, revoke all active sessions, verify the multifactor methods on the account, check whether new email forwarding rules or authorized devices appeared, and pull the machine off the network until somebody has looked at it. Five steps. Ten minutes. That sequence closes the gap that lets an attacker keep working after you think you have handled it.
Do the same thing when an employee leaves, especially on bad terms. Disabling the account is the obvious move. Killing every live session that account holds is the one people forget, and it is the one that matters in the first hour.
The Bottom Line
Passwords and MFA protect the moment you walk up to the front desk. Sessions are what carry you through the rest of the day, and they are protected by an entirely different set of controls that most businesses have never touched.
You do not need to understand the technical mechanics of token theft. You need to know that valid sessions exist, that they can be taken, that a password change does not kill them, and that the settings which limit the damage are already sitting in your accounts waiting to be turned on. That is a very manageable problem for a business of any size.
If you would like someone to go through your business accounts and set session lifetimes, conditional access, and revocation procedures properly, that is routine work for us. We serve small and mid sized businesses throughout Denton County and we are glad to explain every change in plain English before we make it. Contact us today.
Sources:
Comments are closed