Cookie theft
Stealing a user's session cookies (login tokens) and reusing them to take over the account — without needing the password OR the second factor. One of the most effective modern attacks because it bypasses MFA entirely.
Mechanic: when you've logged in (with a password + MFA) your browser gets a session cookie that proves you're logged in. If an attacker steals that cookie — via malware (an infostealer that vacuums up the browser's cookie database), XSS, or a man-in-the-middle phishing page (Evilginx) — they can import it into their own browser and ARE logged in, because the server already trusts the session. MFA doesn't help: it was already verified at login, and the cookie is "after MFA". This is why infostealers became a huge business. Defense: short session lifetimes, binding the session to the device/IP (token binding), detecting impossible travel/device changes, and "device-bound" cookies (DBSC) that cryptographically tie the cookie to the machine. A core threat to today's MFA-dependent security. Related to passwordless auth and token binding.