Prophet Security report says stolen sessions are helping attackers bypass login controls

Prophet Security’s first quarterly threat report says attackers are increasingly getting past passwords by abusing stolen authenticated sessions, based on a full quarter of Prophet AI SOC Analyst investigations from May 1 to July 31, 2026. The findings show identity-related activity in roughly half of confirmed malicious cases and point to session revocation as a gap in many compromise response playbooks.

Why it matters: - The report suggests many security teams have improved password defenses, but attackers are shifting to stolen sessions that can bypass controls at login. - Identity-related activity showed up in roughly half of confirmed malicious investigations, making account takeover a central risk rather than a side issue. - The findings point to a practical response gap: password resets alone may not end an intrusion if sessions and refresh tokens stay active.

What happened: - Prophet Security released its first Quarterly Threat Report covering May 1 through July 31, 2026. - The report analyzed the full set of alerts investigated by Prophet AI SOC Analyst during that period. - Roughly half of confirmed malicious activity involved identity-related tactics. - Credential phishing accounted for about 28% of confirmed malicious investigations. - Direct attacks on accounts and sessions accounted for about 18% of confirmed malicious investigations. - Those direct attacks included session hijacking, token replay, MFA bypass, credential stuffing, inbox rule manipulation and OAuth consent grants.

The details: - Password-based takeover attempts were repeatedly blocked by conditional access or phishing-resistant MFA. - Stolen sessions let attackers reuse an authenticated state without presenting credentials again. - In one investigation, every event relied on Primary Refresh Token authentication and required no credential re-entry. - The report says a password reset would not have revoked that access. - The report recommends adding session and refresh token revocation to account compromise runbooks. - The report also recommends continuous access evaluation and token protection where supported. - Infostealer activity traced back to compromised legitimate websites, fake verification and CAPTCHA gates, malicious advertising and sponsored search results. - Trojanized installers were confirmed at about a quarter of organizations and were the most common first foothold on an endpoint. - Fake AI tool installers appeared at multiple organizations. - One trojanized build of a popular AI desktop application disabled Windows Defender, created persistence through a scheduled task and opened command-and-control channels. - In both AI-lure compromises, the user was trying to install a real product. - One script extracted Microsoft authentication session cookies from the browser and used them to make authenticated API requests. - Those cookies could survive a password reset if the session was not revoked. - Email campaigns repeatedly targeted accounts payable, collections, treasury and finance leaders. - Removal time for malicious email ranged from seconds to more than a day. - Automated post-delivery remediation reduced dwell time to seconds. - In one case, a CEO-impersonation lure stayed in a finance director’s inbox for most of a working day. - In another, a spoofed message that failed SPF, DKIM and DMARC reached more than a dozen inboxes. - Pre-ransomware activity included shadow copy destruction, credential dumping and remote access tool deployment before encryption began. - Several long-running intrusions involved assets without endpoint coverage. - A multi-week credential attack targeted a production identity server with no endpoint agent. - A six-week lateral movement campaign originated from an unmanaged host. - Legitimate commercial remote access tools were confirmed as a persistence layer at about 15% of organizations. - Attackers also used AI tooling in parts of their workflow. - The cookie-theft script was run through an AI coding assistant. - In two account takeovers, attackers accessed the organization’s AI assistant. - In one case, the attackers planted content in the assistant’s chat files as a persistence mechanism. - AI developer tools also generated activity that resembled attacker tradecraft, including remote code execution, runtime compilation and obfuscated commands. - The report says detections that rely heavily on command-line patterns may produce more false positives as these tools become more common.

Between the lines: - The report’s core message is that login security is no longer the whole story; session security is now part of identity defense. - The mix of findings shows attackers using both low-friction social engineering and more technical persistence methods. - The focus on finance users, unmanaged assets and AI-assisted workflows suggests defenders need broader visibility across email, endpoints, identity systems and developer tools. - The data comes from all alerts handled by Prophet AI SOC Analyst, which makes the report more representative of daily security operations than a curated incident sample.

What's next: - Prophet Security says teams should update compromise runbooks to revoke sessions and refresh tokens, not just passwords. - Security teams are likely to keep seeing attackers target authenticated sessions, especially where conditional access stops password-based attacks but not replayed access. - The full report is available as Prophet Security Quarterly Threat Report, Q3 2026. - Prophet Security says its Agentic AI SOC Platform continues to automate alert triage, investigation, incident response, threat hunting and detection engineering.

The bottom line: - Password protection is helping, but session theft is becoming the more dangerous path into enterprise accounts.