CVE-2023-4966 let attackers read valid session tokens out of NetScaler memory and inherit authenticated sessions wholesale — MFA already passed. CISA’s Emergency Directive 23-08 forced hunts and rebuilds as LockBit monetized the access.
Operation Cookie Monster seized the market selling browser sessions, cookies, and saved credentials for ~2M identities, with 119 arrests across 17+ countries. Session-security lessons.
Attackers compromised an Okta support engineer’s personal device, stole the session cookies inside it, and used Okta’s own support console against a customer base estimated at five percent of tenants. BeyondTrust, 1Password, and Cloudflare each detected the downstream activity independently — before the full scope was confirmed.
780 GB of Frostbite engine and FIFA code left EA through a purchased Slack cookie and one help-desk MFA reset. The breach that proved sessions, not passwords, are the modern front door.