GTM Container Injection → Full Session Takeover

Victim Identity (decoded from stolen JWT)

Stolen JWT

Full Session Takeover — paste in incognito console on shop.lululemon.com

Sets cookies + Okta SDK localStorage → reload → full browse control as victim for 2 hours.