For a moment, the access appears to work. You use the phished credentials to generate a valid session token, and the Blackridge intranet accepts it. The screen flickers, and then you are through. A session, a dashboard frame, a thin line of permission you did not earn, just enough visibility to make your heart kick, just enough colour-coded reality to make the abstract suddenly intimate. You are looking at the live, internal interface of PRAP. You lean closer without meaning to, as if proximity could make the numbers more honest. Your excitement fades when you realize the system is watching you back. Not in a sci-fi voice, in the ordinary way: timestamps, session IDs, little breadcrumbs that mean nothing until they mean everything in a compliance review. You close a panel you should not have opened. The screen returns to innocence too quickly, like a person who resumes smiling after saying something cruel. [[Access Without Understanding|Try to access without understanding]] <details> <summary>🔎 Behind the curtain: stolen logins and session tokens</summary> <p>Phishing usually ends with a victim typing a username and password into a fake page. With those, the attacker simply logs in as them. Most systems then hand a logged-in user a <b>session token</b>: a temporary pass the browser presents so you are not asked to sign in on every click. Steal or replay that token and an attacker can sometimes slip straight in, without even re-entering the password. The main defence is <b>multi-factor authentication</b> (MFA): a second proof, such as a code or a tap on your phone, that a stolen password alone cannot satisfy. It is not foolproof, and its absence is how many real breaches begin. In 2022 an attacker got into Uber by buying a contractor's password and then spamming them with login-approval prompts until, worn down, they tapped approve, a trick called MFA fatigue.</p> <p><b>Defender's lesson:</b> turn on phishing-resistant MFA, train people never to approve a prompt they did not start, and expire or device-bind session tokens so a stolen one dies quickly.</p> </details>