Logging in successfully does not end the authentication problem.
It creates a session.
After a service accepts a password, passkey, or multi-factor challenge, the browser usually receives a token or cookie representing that authenticated state. Without it, users would have to sign in again every time they opened another page.
That convenience becomes valuable to an attacker.
Microsoft has documented adversary-in-the-middle phishing campaigns that intercept authentication and capture a session cookie. The stolen cookie can then be replayed while it remains valid, allowing the attacker to impersonate the victim without asking the victim to approve another MFA challenge.
See Microsoft’s analysis of AiTM phishing and business-email compromise.
Google has documented similar cookie-theft campaigns targeting YouTube creators. In those cases, malware stole browser cookies so attackers could hijack already-authenticated accounts.
See Google’s Threat Analysis Group report on cookie theft targeting YouTube creators.
The stolen object is the session, not merely the password
This distinction explains why changing a password is sometimes only part of recovery.
A password proves identity during login. A session token tells the service, for some period of time, that login has already happened.
If an attacker obtains that session state, the service may initially see what looks like an authenticated user rather than a stranger attempting to guess credentials.
That does not make MFA useless. MFA still prevents many account takeovers. It means attackers have adapted to target what exists after MFA succeeds.
End suspicious sessions, not just the original sign-in
After suspected compromise, use the provider’s trusted account-security controls rather than links sent in an alarming message.
Change compromised credentials, review recent sign-ins and connected devices, remove suspicious applications, and use the provider’s option to sign out other sessions where available. A device or browser you do not recognize should not remain trusted merely because the password has been changed.
If the compromise began with malware, the affected device also needs to be cleaned before it is trusted again.
A session is supposed to save the user from proving identity fifty times before lunch.
Session theft turns that convenience around.
The attacker does not necessarily need to become you at the login screen.
The attacker wants the service to believe that part already happened.