Session compromise is the unauthorized takeover of an active authenticated user session. Instead of stealing a password and logging in from scratch, an attacker abuses a session that is already trusted by the application, device, or identity provider. Because the session is “live,” the attacker may inherit privileges, single sign-on state, cookies, tokens, or device trust without knowing the original credentials.
This matters because many modern attacks target the session layer rather than the login screen. In Windows and cloud identity environments, a compromised desktop session can sometimes be used to access mail, cloud apps, or identity tokens, even when passwordless sign-in is in use. Defenders look for unusual token use, unexpected device registration, privilege changes, or sign-ins that follow endpoint compromise. Good defenses include short-lived tokens, reauthentication for sensitive actions, device isolation, token revocation, and tight monitoring of session and identity events.