Token theft
Also known as Session hijacking, Cookie theft
Stealing the session token issued after a successful login, letting an attacker resume the session without credentials or MFA.
After you authenticate, the service issues a token so you are not challenged on every request. If malware or a phishing proxy captures it, the attacker replays it and is signed in as you, having satisfied MFA already.
Shorter session lifetimes, continuous access evaluation, and binding tokens to a compliant device all reduce the window. It is the leading reason MFA alone is no longer sufficient on its own.
Where this comes up
Token theft sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.