session hijacking
Taking over someone's logged-in account by stealing the token their browser already holds, which sidesteps both the password and two-factor authentication.
When you log into a website, the site does not ask for your password again on every page. It hands your browser a session cookie, a small token meaning “this person already proved who they are.” Every request afterwards presents that token instead.
Session hijacking is simply copying the token and using it somewhere else. Because the login already happened, the attacker never sees a password prompt and never triggers two-factor authentication. This is why a very strong password is not, on its own, protection: the lock was never picked, the key was photocopied. The usual defences are on the other side, signing out sessions when something looks wrong, tying tokens to a device, and keeping the machine free of the malware that copies them in the first place.