Skip to content
Cyber Security

Infostealers and stolen session cookies: why MFA didn't stop it

How infostealer malware such as Lumma steals browser passwords and session cookies, why MFA doesn't stop a stolen session, and the settings that do.

Geidi Security Operations Team6 min read

In brief

What it is
Infostealer malware copies browser passwords and session cookies, and a stolen session cookie signs an attacker in with no MFA prompt.
Who it affects
Any Microsoft 365 organisation that turned on MFA and assumed the job was done.
What to do
Stop saving passwords in the browser and require compliant or joined devices for Microsoft 365, so a stolen cookie alone gets nowhere.
On this page
  1. How it works
  2. The takedown didn't end it
  3. Are you affected?
  4. How to fix it
  5. If you think it already happened
  6. Where Geidi fits
  7. Sources

Someone signs in to a staff member's Microsoft 365 account from another country. There's no MFA prompt, no alert on their phone, nothing. The password wasn't guessed and nobody approved a sign-in. The attacker simply presented a copy of the session cookie from the staff member's browser, and Microsoft 365 treated them as already logged in.

That cookie usually comes from an infostealer: malware that grabs everything useful from a computer in a few seconds and sends it off to be sold. It's one of the most common starting points for business email compromise and ransomware, and it walks straight past MFA. If you've turned MFA on and assumed the job was done, this is the gap.

How it works

Infostealers arrive the ordinary ways: a fake software download, a pirated game or app, a malicious ad, or a fake "verify you are human" page like the ones in our ClickFix explainer. Once running, they collect and upload what they find, then often delete themselves.

Microsoft's May 2025 analysis of Lumma Stealer shows what that means in practice. Lumma pulls saved passwords, session cookies and autofill data from Chromium browsers (including Edge) and Firefox-family browsers, along with crypto wallets, VPN configuration files, email and FTP clients, and documents from the user's folders.

The session cookie is the valuable part. When you sign in and complete MFA, the service gives your browser a token that says "this person has already proved who they are". An attacker who copies that token can often carry on the session from their own machine without ever seeing a password or MFA prompt. Stronger MFA, including passkeys, protects the sign-in. It doesn't protect the session after the sign-in.

The takedown didn't end it

In May 2025 Microsoft's Digital Crimes Unit obtained a US court order and, working with the US Department of Justice, Europol and Japan's JC3, took down about 2,300 domains behind Lumma. The DOJ seized its control panel. Microsoft said it had found more than 394,000 infected Windows computers worldwide in the two months before the action.

It helped, for a while. In February 2026 Bitdefender reported a considerable increase in Lumma activity, delivered through a loader called CastleLoader and lures such as fake CAPTCHA pages. Other stealers fill any gap: a 2026 ACSC advisory about hacked Australian WordPress sites described fake verification prompts delivering Vidar Stealer. Plan on the assumption that some stealer will always be in circulation.

Are you affected?

You're exposed if staff sign in to work accounts in a browser that also stores passwords, if they can install software themselves, or if they reach Microsoft 365 from personal computers you don't manage. The last one is the easiest to miss. A family laptop with a pirated game on it is a perfectly good place to steal a work session from.

Signs to look for:

  • Sign-ins from unfamiliar countries or hosting providers, especially ones that show no MFA step.
  • New inbox rules that forward, delete or hide email.
  • Staff who recently installed "free" software, cracked apps or browser add-ons, or pasted a command from a website.

How to fix it

Aim to make stolen passwords scarce and stolen cookies useless. In rough order:

  1. Stop saving passwords in the browser. Set the PasswordManagerEnabled policy to disabled in Edge and Chrome through Intune or Group Policy, and give staff a proper password manager instead. It won't stop cookie theft, but it takes the password list off the table.
  2. Require compliant or joined devices for Microsoft 365. A Conditional Access policy that requires a device marked compliant in Intune (or Microsoft Entra hybrid joined) means work data only reaches machines you manage, and a session replayed from an attacker's computer gets much less.
  3. Turn on token protection where it fits. Token protection in Conditional Access binds sign-in tokens to the device they were issued to. As of September 2026 Microsoft lists it as generally available for native apps on Windows, macOS and iOS, but browser support is still a preview limited to selected web apps that access Azure Resource Manager. So it protects Outlook, Teams and the Office apps, not a stolen browser cookie. Use it, and don't oversell it.
  4. Use a managed browser. Microsoft Edge for Business signed in with the work account, with extensions allow-listed, updates forced and personal profiles kept separate from work ones. Browser extensions are another route to the same cookies.
  5. Stop users installing software. Standard user accounts, application control and Defender's attack surface reduction rules remove most of the ways a stealer gets to run. These line up with the Essential Eight.
  6. Keep sign-in sessions short where the risk is high. Conditional Access sign-in frequency for admins and finance staff limits how long a stolen session lasts. Everyone else can keep longer sessions.
  7. Watch for the tell-tale sign-ins. Microsoft Entra ID Protection and Defender flag anomalous tokens and impossible travel, but someone has to look at the alerts.

If you think it already happened

Treat the computer and every account used on it as compromised.

  • Take the computer off the network and rebuild it. Cleaning infostealer infections in place is rarely worth the risk.
  • From a clean device, reset the user's passwords, starting with Microsoft 365, email, banking and anything saved in the browser.
  • Revoke their sessions: in the Microsoft Entra admin centre, open the user and select Revoke sessions, or run Revoke-MgUserSignInSession. Microsoft's guidance for an emergency is to also disable the account while you investigate, because tokens already issued can keep working for a short time.
  • Check the mailbox for new rules and forwarding, and look at recent sign-ins for the same account.

Report it to ASD's ACSC at cyber.gov.au (opens in a new tab) ("Cybercrime" for most businesses, "Cyber security incident" for organisations with 250 or more staff, government and critical infrastructure) or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). If customer or staff personal information may have been accessed, check whether the Notifiable Data Breaches scheme applies.

Where Geidi fits

Our cyber security services are aligned to the Essential Eight and backed by a 24/7 security operations centre. If you'd like to talk about infostealers, talk to us.

Sources

More on Cyber Security

One partner for the whole environment.

Tell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.

Book a consultationCall 1300 855 049