Identity Provider Session Hijack Campaign Escalates

## What happened Infostealer logs and browser cookie dumps were traded and operationalized for direct portal access. ## Why this matters beyond one victim Identity platforms are transitive trust anchors. One compromised admin session can cascade into many environments. ## Technical notes Successful intrusions often lacked conditional access enforcement tied to device posture and token age.