Session Hijacking

Session hijacking is the theft of an authenticated session rather than a password. When a user logs in, the service issues a session cookie or token that says "this browser is already authenticated — don't ask again." An attacker who obtains that token steps directly into the logged-in session, past the password prompt and past multi-factor authentication, because from the service's perspective authentication already happened.

How it works

Modern session hijacking runs on three main supply chains. Adversary-in-the-middle phishing kits proxy a real login page and capture the session cookie the moment it is issued — the victim completes MFA and hands over an authenticated session in the same motion. Infostealer malware raids browsers on infected machines, exfiltrating saved cookies by the thousand; these are sold in criminal marketplaces as "logs," complete with the device fingerprint needed to replay them convincingly. And on unsecured networks or misconfigured applications, tokens can still be intercepted in transit, though universal HTTPS has made this the rarest path.

What makes the technique dangerous is longevity. Cloud session and refresh tokens can remain valid for days or weeks, and — critically — many remain valid even after the victim changes their password. Incident responders who reset credentials but skip token revocation leave the attacker logged in. It is the step most teams miss, a point we emphasize in the post-scan incident response section of our QR code phishing guide.

How to defend against it

• Revoke sessions during every credential reset. Password change plus session and refresh-token revocation must be a single atomic action in your incident playbook.
• Shorten token lifetimes for sensitive applications, and require re-authentication for high-risk actions like payments and admin changes.
• Bind sessions to context. Conditional access that evaluates device compliance and location on each request makes a replayed cookie from attacker infrastructure stand out.
• Cut off the sources. Phishing-resistant MFA (passkeys) defeats the AiTM path, endpoint protection addresses infostealers, and simulation-based training reduces the clicks that start both.