We Reset the Password. We Reset 2FA. The Attacker Came Back in Seconds.

A session hijacking war story, and why the application layer is your last, best line of defense.