Infostealer malware on an employee's laptop exfiltrates browser cookies. Hours later, an attacker opens the company's AI assistant web portal from another country and reads the employee's full conversation history without receiving any password or MFA prompt. Which attack BEST explains this access?

Session hijacking occurs when an attacker obtains a valid session token, often stored in a browser cookie, and presents it to the service to assume the victim's authenticated session. Because authentication and MFA were completed when the session was created, the service accepts the token without prompting again. Infostealer malware commonly harvests such cookies, and AI services are attractive targets because conversation histories may contain sensitive business information. Password spraying tries common passwords across many accounts and would require completing authentication, including MFA, which the attacker never encountered. Prompt injection manipulates a model's behavior through malicious instructions in its input; here the attacker accessed stored history directly through the portal rather than tricking the model into revealing it. MFA fatigue bombards a user with push prompts until they approve one, but the scenario explicitly states that no MFA prompt occurred, which is the signature of token reuse rather than authentication abuse. Exam caveat: MFA protects the login event, not a session that already exists, which is why token theft is a common MFA bypass. Operational check: revoke the employee's active sessions and tokens, reimage the infected laptop, shorten session lifetimes, enable token binding or conditional access that reevaluates device and location, and alert on session use from new locations.