The Token Is the New Password
Leidos, Friday, October 23rd, 2026
Leidos explains why session token theft bypasses MFA and how cheap infostealer tooling has made it a mainstream attack.
Leidos says token theft works because it happens after authentication, so multi-factor authentication never comes into play.
After login, a session token proves a user's identity to email, work systems or banks, and an attacker who steals it inherits the session without the password or MFA prompt.
Leidos describes tokens as bearer credentials trusted by whoever holds them, and notes that infostealer malware and cheap tooling have made token theft operationally easy, requiring no special skill or targeting.