Cookies for Criminals: The Underground Market Fueling MFA Bypass

Adversaries don’t need passwords when they have your tokens. In this webinar, Nick Ascoli, Director of Product Strategy, uncovers the evolving tradecraft behind session hijacking and cookie theft—two increasingly common techniques leveraged by cybercriminals to bypass MFA, impersonate users, and maintain long-term persistence. He’ll explore how threat actors harvest and weaponize session tokens, how these credentials are trafficked in the cybercrime underground, and how defenders can identify the telltale signs of a takeover. Using real-world intelligence and Flare data, this webinar will walk through: Common collection methods (info-stealers, XSS, token sync abuse) How session cookies are used in post-compromise scenarios Trends in cookie-based access sales on dark web markets Detection strategies and incident response best practices By the end of this webinar, you’ll understand how session tokens function as high-value credentials—and how attackers exploit this blind spot to bypass even your strongest authentication controls.