A login token is a credential that proves a user has already authenticated. It can be a bearer token, session token, or session cookie, and in some systems it lets a service accept requests without asking for the password again. Because the token carries the trust of the original login, anyone who steals it may be able to reuse the session until it expires or is revoked.
In cyber security, login tokens matter because they turn a one-time login into an ongoing access path. Infostealer malware, browser theft, phishing proxies, and endpoint compromise often target these tokens so attackers can bypass normal login checks, including MFA in some cases. Defenders reduce risk by shortening token lifetimes, binding sessions to devices or risk signals, revoking active sessions after compromise, and limiting what each session can do through least privilege.