Authenticated Session Theft Lab

A stolen password is not the only way to take over an account. This lab shows why an authenticated browser session is itself a valuable credential and why multifactor authentication cannot protect a session after it has already been issued.

Goal

Explain the difference between password theft and authenticated-session theft, then build a safe response plan for a suspected session hijack.

Activity

1. Draw a normal sign-in sequence: password, multifactor check, session token and authenticated requests.
2. Copy the diagram and add an infostealer that takes the active session token after sign-in.
3. Mark where multifactor authentication helps and where it no longer participates.
4. Put these response actions in a defensible order:
   • disconnect and inspect the suspected device;
   • use a known-clean device;
   • terminate active sessions;
   • rotate passwords and recovery credentials;
   • review account activity and charges;
   • restore or rebuild the infected device;
   • monitor for reuse of other stolen credentials.
5. For each action, state what risk it reduces and what risk remains.

Do not install malware, capture real browser cookies, inspect another person’s account or use live credentials. Use only the diagrams and fictional account data supplied by the instructor.

Deliverable

Submit:

• both authentication diagrams;
• a table with response action, purpose and remaining risk;
• a 150–200 word incident-response recommendation;
• one sentence explaining why changing a password alone may not terminate every active session.

Discussion and safety

• Why is a session token functionally similar to a temporary credential?
• Why can session theft make multifactor authentication appear to have failed even when the attacker never defeated it?
• Why should session termination be performed from a known-clean device?
• Which other accounts might be exposed when an infostealer compromises a browser profile?

This is a defensive analysis exercise. It does not require access to tokens, malware or another user’s device.

Source material

This lab was first developed from the PTIR Daily Briefing for August 31, 2026. BleepingComputer reported that Anthropic notified affected users about general-purpose infostealer malware stealing active Claude login sessions and consuming account usage. Anthropic’s public help documentation separately confirms that users can inspect and remotely terminate active sessions. The story generated this lab because beginning technology students often treat passwords and multifactor authentication as the whole authentication system, overlooking the credential-like session issued after sign-in.

Consult the original report: Anthropic warns infostealer malware is hijacking Claude sessions to drain usage.

Consult Anthropic’s official control guidance: Managing your active sessions.