What is a session token, and why is stealing one worse than stealing a password?

Short answer: A session token is the credential your browser or app holds after you log in, proving you're already authenticated. Stealing one is often worse than stealing a password because it typically bypasses both the password and multi-factor authentication — the attacker simply resumes your existing session. 
 Why it exists 
 Re-entering a password on every request would be unusable, so after a successful login the service issues a token. Every later request carries that token instead of your credentials. The service trusts it as proof you already authenticated. 
 Why attackers prefer it 
 
 It skips MFA. MFA is checked at login. A token issued after that check represents an already-passed authentication, so replaying it usually doesn't re-trigger the second factor. 
 It looks legitimate. To the service, a valid token is a valid user. There's no failed-login signal and nothing anomalous to alert on. 
 It's portable. Many tokens work from a different machine, network, or country. 
 
 Why this changed attacker behavior 
 Attackers increasingly avoid lingering in a network. Staying resident raises the odds of detection. Instead they take identity material and leave — then return at will as an authenticated user. The token is a legitimate-looking back door that the authentication system itself issued. 
 How Cyber Crucible addresses it 
 Token theft is stopped at the moment of access. When a program reaches for the browser or application storage where tokens live, its access is assessed in under 200 milliseconds. An overreaching but legitimate program is given fake data or denied; an unknown or compromised one is rejected or suspended. Either way the real token is never handed over.