After a successful sign-in, a website does not ask for your password after every click. The browser receives a small session identifier, usually kept in a cookie or similar storage. The server recognises it and knows that sign-in has already happened.
That is convenient. It is also why an attacker may not need your password or another MFA code. If they steal a working session token and the service accepts its reuse, they can try to enter as an already signed-in user.
Where a stolen session comes from
An infostealer is malware focused on taking data from a computer: saved passwords, cookies, tokens, cryptocurrency-wallet data, and device information. It often arrives as an “activator”, fake update, mod, cheat, attachment, or installer downloaded from an advert.
Not every leaked cookie opens every account. Services bind sessions to devices in different ways, may demand fresh authentication, and can detect unusual access. You should not, however, assume that MFA automatically invalidates a token stolen after a valid sign-in.
Why a password change may not be enough
Changing the password stops future sign-ins with the old password. Not every service ends every existing session at the same time. An attacker may still have an open mailbox or social account and use it to alter recovery settings.
If session theft is possible, the order matters:
First disconnect the suspect computer from the network; do not power it off if examination may be required.
- Use a different, trusted device. Do not type new passwords on the computer that may have run the infostealer.
- In the account settings, choose “sign out all devices”, “end sessions”, or the closest equivalent.
- Change the password to a unique one and review MFA, passkeys, recovery email, phone number, and mail-forwarding rules.
- Start with primary email and the password manager, then move to banking, cloud storage, and social accounts.
- Save the times of alerts, session lists, and provider messages. They may help establish the scope.
Scanning the suspect computer alone does not prove it is safe again. Updates and built-in Microsoft Defender matter, but another consumer antivirus does not replace revoking access. For an unknown file, check the hash in VirusTotal first, remembering that “zero detections” is not a guarantee and private files should not be uploaded.
If an account is already under someone else’s control, use the account takeover emergency card. For a more serious event, decide how the suspect computer will be restored or examined before using it heavily again.