Pass-the-Hash So that it does not keep the password in readable form, Windows remembers its cryptographic fingerprint — the hash. With older Windows authentication (NTLM), the password is not required to prove identity; the hash is enough. Pass-the-hash abuses exactly that: if the attacker obtains a user's hash, they can log in with it without ever learning the real password.

Session Hijacking When you log in, the service opens a session — a state that remembers you are you, together with everything that goes with it, such as your preferences and settings. The main benefit is that you do not have to type a password every few minutes as you move through the features. That session is marked by an identifier, usually held in a browser cookie. Session hijacking is the taking over of a session that is already open. The attacker does not attack the login; they slip into a session that has already passed authentication and carry on operating the service in your name.

Third-Party Compromise Third-party compromise happens when the attacker does not go at an organization directly but at a supplier, a partner, a service provider or an external associate who already holds some form of trust and authorized access. Instead of forcing the front door, the attacker looks for a side entrance somebody else has already opened.

Token Theft A token is proof that you have already logged in. When you sign in and confirm your identity with a second factor, the service issues a token, stored in the browser, which vouches that you have already been checked the next time round. The token is sent automatically with every further request, so you do not have to type the password again. Token theft is the taking of that proof. With it in hand, the attacker presents themselves as you — without your password and without the second factor, because both have already been approved.

Worm A worm spreads on its own. Unlike a virus it needs no host file and no click from the user — once it is on one machine it immediately looks for the next, and the next, and thousands of devices can be infected within minutes. Replication is its purpose, speed is its weapon, and whatever it carries is the real threat.