A global manufacturing enterprise narrowly avoided a ransomware deployment after threat actors used stolen session cookies, harvested by an infostealer on an unmanaged employee device, to bypass MFA and authenticate as a legitimate user across VPN and Active Directory environments. The attack was detected not by internal controls but by an external threat intelligence alert, exposing a systemic blind spot: session token trust is not governed by the same controls organizations apply to credentials. This incident signals a maturing attacker playbook in which infostealers serve as ransomware precursors, and unmanaged devices are the entry point of choice precisely because they exist outside corporate visibility.