At a cloud email service that uses multi-factor authentication, an employee was lured to a login screen that looked exactly like the real one and entered a password and a one-time password. The attacker used that screen as a relay to the real service, stole the session cookie issued after login and impersonated the employee. Which of the following most appropriately describes this attack and the countermeasures?

Answer: C. A stolen cookie represents a state in which multi-factor authentication has been completed, so revoke the session at once and combine passkey-style authentication, shorter sessions and detection of unusual use

When authentication succeeds, the service issues a token such as a session cookie, and subsequent requests are treated as coming from the user on the strength of the token alone. If the token is stolen through relay-type phishing (AiTM) or by information-stealing malware on the endpoint, the attacker can therefore impersonate the user in a state where multi-factor authentication has already been completed. On noticing the damage, not only must the password be changed, but the sessions already issued must be revoked. Prevention combines phishing-resistant authentication bound to the domain being connected to, such as passkeys, shorter session lifetimes and re-authentication or usage restrictions in response to changes in location or device.

• A. Multi-factor authentication works at login; a token stolen afterwards is used in the state where authentication has already been completed.
• B. In a relay attack the real user enters the correct password, so its length is irrelevant.
• C. Correct. After revoking the sessions, combine phishing-resistant authentication with session management.