Changing Your Password No Longer Kicks Hackers Out
A growing wave of attacks steals not passwords but the digital passes that keep you logged in, meaning a password reset leaves the intruder sitting comfortably inside your account.
Key points
- Device-code phishing, a trick that hijacks sign-in sessions without stealing passwords, is surging against Microsoft and Google accounts.
- Multi-factor authentication (MFA), the extra code sent to your phone at login, does not stop these attacks because criminals steal access after the login succeeds.
- Security experts warn that resetting a password leaves every existing session alive, meaning the attacker stays connected unless tokens are separately revoked.
- Organisations with long-lived or poorly monitored session tokens are most exposed to persistent, undetected access.
When a hacker wants into your account, the obvious target is your password. Security teams have spent years making passwords harder to steal, and it has worked well enough that attackers are now going around the lock entirely, stealing the key that your device receives once you have already logged in.
That key is called a session token, a small piece of data your browser or app holds to prove you are already authenticated, so you do not have to log in again every few minutes. Steal that token and you can walk into someone's account without knowing their password or triggering an MFA prompt.
How do criminals steal a token without touching your password?
The fastest-growing method is device-code phishing. Here is how it works in plain terms: a criminal sends you an email that looks like a genuine Microsoft or Google notification. It contains a short code and a real login page, because it is a real login page. You type the code in. That action tells Microsoft or Google to grant access to the criminal's waiting session, not yours. You see nothing unusual. They are now inside.
Because you authenticated legitimately, the platform's systems see normal behaviour. MFA was satisfied. No suspicious login failure appears in the logs. From the platform's point of view, reported at length by Dark Reading, the criminal looks exactly like you.
Other methods work similarly: criminals steal browser cookies (small files your browser stores to keep you logged in), abuse OAuth tokens (short-lived passes that let one app act on your behalf inside another), or break into a single sign-on platform to gain access to every service it connects to in one step.
Should affected users and organisations be worried?
Yes, and the concern has a practical edge. The most common emergency response to a hacked account is changing the password. That step does not end an active session.
"When you're triaging a compromised account, you need to explicitly revoke all active refresh tokens as a separate step," says Denis Calderone, CTO at Suzu Labs. A refresh token is a longer-lived pass that silently issues new session tokens in the background. Leave it intact and the attacker simply keeps refreshing their access.
The fix requires deliberately signing out every active session, then revoking outstanding tokens, inside whatever identity platform the organisation uses.
What should organisations actually do?
Experts point to four concrete changes worth making now.
| Action | What it means in plain terms |
|---|---|
| Use phishing-resistant MFA (FIDO2 keys or passkeys) | A physical security key or device-bound passkey cannot be intercepted by device-code tricks |
| Bind tokens to specific devices | A stolen token becomes useless on any other machine |
| Block device-code authentication for most users | Most employees never need it; disabling it removes the attack path |
| Monitor sessions after login, not just at login | Flag a user who suddenly appears on a different device type or an unexpected city |
Hayden Covington of Black Hills Information Security puts the goal simply: "Monitor ongoing sessions for anomalies that suggest the person behind the session isn't the user who started it."
John Laliberte of ClearVector adds a point that IT teams often miss. Non-human accounts, such as automated scripts, third-party software integrations, and API connections, hold session tokens too, and nobody reviews their permissions after the initial setup. Criminals exploit exactly that neglect.
For individuals, the practical steps are modest: sign out of accounts you are not using, review which third-party apps have permission to access your email or calendar, and treat any unexpected login-code email as suspicious even if the page it links to looks genuine.
