[ViViDboarder]

Or just steal your session tokens. Not all apps are secure enough to prevent session roaming.

[dwaite]

Or just remote drive your session. Token exfiltration isn't required if you can do XSS or say script injection via browser extensions (and exfiltration is more likely to hit anomaly/fraud detection)