A valid session cookie removes the attacker's need for both the password and MFA. Case closure starts with session revocation.
Stealer records often carry browser cookies alongside the password. The two are not equivalent: a password is an input to authentication, a cookie is an already authenticated session.
Order matters
- Revoke every active session for the user. If "sign out everywhere" is not enough on the identity provider side, invalidate the tokens too.
- Reset the password.
- Review MFA registrations; the attacker may have enrolled a device while inside.
- Revoke application passwords and API keys created during the session.
The step that gets missed
Item four is skipped most often. In a short session an attacker leaves a durable foothold: an OAuth grant, a mail forwarding rule or a personal access token. These keep working long after the session ends.
The measure
Close the case on "sessions revoked, persistence swept", not on "password changed". The difference costs a few minutes and saves weeks.
