MITRE ATT&CK T1539 is the technique of stealing web session cookies or similar session artifacts and using them to impersonate a user. Because the cookie already represents an authenticated browser session, the attacker may not need the password, multi-factor prompt, or even the original device. In practice, this can turn a simple browser theft into full account access.
This matters because modern services often trust active sessions more than credentials. Attackers steal cookies from browsers, memory, or local storage with stealers, infostealers, and malicious extensions, then replay them from another machine to hijack accounts. Defenders look for unusual session reuse, impossible travel, repeated token refreshes, and browser-data theft on endpoints. Strong defenses include session revocation, short session lifetimes, reauthentication for sensitive actions, device binding where possible, and protecting browser data from malware.