New Pass-the-Cookie Attacks Bypass MFA, Giving Hackers Full Account Access

Pass-the-Cookie attacks exploit stolen browser session cookies (e.g., ESTSAUTH) harvested by infostealer malware to bypass MFA and gain persistent access to Office 365/Azure accounts; the report includes a proof-of-concept, identifies malware families (LummaC2, Redline, Racoon), notes a substantial increase in cookie-theft activity, and recommends mitigations such as session token monitoring, conditional access, Continuous Access Evaluation, and strengthened EDR controls.