Criminals take over accounts without passwords using stolen sessions and phone numbers

Account thieves can take over online accounts without passwords by hijacking sessions, tricking users into approving sign-ins, seizing phone numbers, or using malware, according to Fox News reporting published Oct. 31, 2026 and CyberGuy reporting published Oct. 28, 2026.

Fox News and CyberGuy say passwords remain important but are only one component of the identity-protection system. The outlets disagree on the count, with Fox News describing six techniques and CyberGuy listing five ways criminals bypass password protection. Huntress reports that attacker tactics moved away from credential theft toward session hijacking between 2020 and 2025, and that sessions are now the main prize. Javelin Strategy & Research reported 15.6 billion dollars in account takeover losses for 2024, Identity.org states.

Fox News and CyberGuy explain that services create sessions so users stay signed in without typing passwords again, and that criminals can take the digital tokens or cookies linked to sessions and get in without a password or verification step. Taking a device off an account list does not always end an active login session, they say. Huntress describes stolen session tokens as active keys that bypass MFA prompts. Stolen tokens do not trigger login alerts, Huntress says, and many tokens stay valid after a password reset unless they are explicitly revoked or expired.

Huntress says infostealers gather browser session tokens and authentication cookies. Those tokens work for critical infrastructure, developer platforms, cloud services, and e-mail without passwords or MFA prompts. Stolen data goes on sale in dark web markets, and attackers replay it using automation tools. Attackers can skip controls, move across systems sideways, and launch ransomware, extortion, or intellectual property theft within one hour.

Huntress says infostealers capture cookies from Google Workspace, Microsoft 365, and Slack. They also take developer tokens for GitHub, AWS, and CI/CD systems. Logs sell for about $5 to $25. Logs with Microsoft 365, Slack, Okta, or AWS tokens are more valuable, reaching $100 to over $500.

Fortune 500 credential logs go for $100 to over $500, with the price depending on exclusivity. Discord tokens sell for $5 to $20. AWS IAM session tokens cost $100 to $500.

Huntress says 1Password vault exports sell for $300 to $1,000 and Bitwarden vaults for $200 to $700. KeePass databases go for $100 to $500, and browser vault exports cost $25 to $75. Initial access brokers sell curated access to espionage clients, extortion groups, and ransomware affiliates for thousands of dollars per credential. Huntress describes one broker who took a raw log worth about $10.

The broker turned it into a developer access bundle reselling for more than $1,000, a 10,000 percent return.

Deep Identity says session hijacking relies on browser-in-the-middle proxies, malicious extensions, or cross-site scripting to grab tokens from logged-in users and bypass password defenses completely. Admin By Request says man-in-the-middle session hijacking captures passwords, MFA codes, session cookies, and tokens, and that tools such as Evilginx make it accessible.

Identity.org says Proton discovered over 300 million stolen credentials still circulating on the dark web. Identity.org says Akamai’s 2024 research counted about 26 billion credential-stuffing attempts per month. Deep Identity says credential stuffing made up roughly 34 percent of account takeover incidents tracked by the Identity Theft Resource Center in 2025.

Fox News and CyberGuy say criminals may persuade a carrier to move a victim’s number to a SIM or eSIM under their control, after which the attacker gets the victim’s calls and texts plus verification codes. Identity.org says SIM-swap fraud allows attackers to intercept SMS verification codes and reset passwords after convincing a carrier to move a number to a new SIM.

Deep Identity says SIM swap fraud losses in North America went above $400 million during 2025. FBI figures cited by Admin By Request put SIM swap losses at $12 million across 320 incidents from 2018 through 2020, and at $68 million across 1,611 incidents in 2021.

Fox News and CyberGuy say MFA fatigue, also called push bombing, sends repeated approval notifications until the user taps Approve to make them stop. They say criminals might pose as tech support or a bank and ask the victim to read out a one-time security code. Admin By Request says MFA bombing uses stolen credentials to set off repeated login notifications until a victim approves one out of frustration or confusion.

Admin By Request says the LAPSUS$ group used MFA bombing during 2022 attacks on major tech companies. Identity.org says an attacker pretended to be Uber IT in the 2023 Uber breach and convinced a victim to approve an MFA request. That shows repeated manipulation can defeat well-configured multifactor authentication. Microsoft research indicates MFA blocks 99.9 percent of automated attacks on accounts, Admin By Request says.

Infostealer malware steals browser passwords and session cookies, Fox News and CyberGuy say. It also takes payment data and arrives through fake updates, pirated apps, attachments, ads, or compromised extensions. Deep Identity says generative AI made phishing more convincing by taking out grammatical errors and awkward phrasing.

Fox News and CyberGuy say the FBI’s September 2026 warning covered criminals tricking people into giving malicious applications account access that survives password changes.

Fox News and CyberGuy say passkeys reduce password-phishing risk but fail to stop attacks on sessions, infected devices, connected apps, or account recovery. Fox News and CyberGuy say changing a password may not remove all access because some services keep sessions active until signed out separately. Attackers may add app passwords, connected applications, recovery methods, or e-mail forwarding rules that remain after a password change, they say.

Fox News and CyberGuy recommend monthly session reviews, passkeys or security keys, carrier PINs and port-out locks, and reviews of connected apps and forwarding rules. They say identity monitoring services track accounts, credit, and exposed personal information, though no service prevents every form of identity theft.

Huntress says defenses include short session lifetimes, Secure and HttpOnly cookie flags, behavior monitoring, user education, and canary credentials. Admin By Request recommends number matching, rate limits on authentication attempts, session timeouts, monitoring, authenticator apps, hardware security keys, and ending reliance on SMS-based MFA.

CyberGuy says it created the article in partnership with LifeLock. The LifeLock Core plan delivers combined identity theft coverage of $1.05 million, including up to $1 million for legal and expert support. LifeLock Advanced gives up to $1.2 million in combined coverage and three-bureau credit monitoring. LifeLock Total provides up to $3 million in combined coverage with home title monitoring and 401(k) and investment account alerts.

“A few minutes reviewing your settings today could save you a great deal of trouble later,” said Kurt “CyberGuy” Knutsson. Fox News and CyberGuy say a sudden loss of service without a known local outage, an unexpected carrier device-change notice, or an unrequested password-reset message can signal a SIM swap.