What a clickbait title. It notably does not provide persistance beyond the length of the session they steal the auth for. So max of 90 days but only in an environment that allows the "keep me signed in" checkbox with the longest time allowance. Don't be a dummy with your settings. No methods given to pivot directly to longer persistance, just some vague situational hypotheticals.
This is nothing new. The Varonis page linked to by this article is an educational proof of concept guide to how an attacker could leverage a number of things that have existed for a while, showing just how far an attacker can get if they manage to snag the session cookie for an authenticated Azure (or other cloud service) session.
It includes some example code for a cookie stealer chrome extension, PowerShell code for temporarily deploying said extension to a local Chrome install, links some tools, and provides instructions on how to pivot the session cookie into other info and the actual session and refresh tokens.