Questions regarding tokens/sessions maliciously created during Phishing

Question

Hello,

I have a few questions related to Phishing attacks that steal creds/create sessions for threat actor:

• If a threat actor steals a token/creates a malicious session using cred proxy, can they keep refreshing it themselves?
• Fastest way to kill a suspected stolen token/malicious session (is there a lag)?
• Does reset password kill all sessions?

Thanks!

Answer 1

Hello,

 

Thank you for posting in Q&A forum.

Yes, the session can be kept and refreshed even the password is changed.

 

From network aspect, once you detect any suspicious IP address you can prevent the session by blocking the IP address. Otherwise, you need to check if there's any securify measures for your application (e.g. Microsoft Defender for office 365 can safeguard your organization against malicious).

 

To help other customers who may be facing the same issue, please don't forget to vote if the reply is helpful.

 

Best regards，

Jill Zhou