Session tokens past MFA. The access path.
Infostealer logs carried AI session tokens that replayed without a prompt. Replayed session tokens open AI accounts without a password and without an MFA prompt.
The record
Entry point. infected-laptop, Lumma Stealer or Vidar, log sold or dumped.
The identity in the middle. A stolen session token, replayed through a proxy that hid the location.
What was reached. ai-account, no password prompt, no MFA challenge.
Infostealer logs carried AI session tokens that replayed without a prompt.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| infected-laptop | Entry | Lumma Stealer or Vidar, log sold or dumped |
| browser-storage | Step | sessionStorage and localStorage copied |
| session-token | Step | JWT replayed, proxy hides the location |
| ai-account | Reached | no password prompt, no MFA challenge |
Where a breakpoint would have been
Token lifetime and binding. MFA is already behind the attacker at this point, so the controls that matter are how long the session stays valid and whether it is tied to anything the attacker does not also hold.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
4 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the Session tokens past MFA incident?
The published path starts at infected-laptop, Lumma Stealer or Vidar, log sold or dumped.
What did it reach?
The last step in the published path is ai-account, no password prompt, no MFA challenge.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.