What is Session Hijacking?
Session Hijacking is an attack in which an adversary steals a valid session token to impersonate an authenticated user without knowing their password or satisfying MFA. The attacker effectively inherits the victim's active session and all permissions tied to it.
What it is
Session Hijacking occurs when an attacker obtains a legitimate session token and uses it to access a system as if they were the authenticated user. Session tokens are issued by applications after a successful login. They act as a temporary proof of identity. If an attacker captures one, they can skip the login step entirely, including any MFA challenge.
Common methods of token theft include:
- Cross-site scripting (XSS): Malicious scripts in a web page read the token from the browser.
- Network interception: Unencrypted traffic exposes tokens in transit.
- Malware: Credential-stealing malware reads tokens from browser storage or memory.
- Adversary-in-the-middle (AiTM) phishing: A proxy site sits between the user and the real service, capturing the token in real time after the user completes MFA.
AiTM phishing kits have made session hijacking one of the most common ways attackers bypass MFA today.
Why it matters
A stolen session token gives an attacker the same access level as the victim, for as long as the session remains valid. Tokens for privileged accounts, admin consoles, or cloud management planes can expose entire environments. Because the attacker presents a valid token, many systems log the activity as normal user behavior, making detection hard.
How tools address it
Identity Threat Detection and Response (ITDR) tools are the primary product category built to detect and respond to session-based attacks. They look for signals such as:
- The same session token appearing from two different IP addresses or countries.
- Sudden changes in device fingerprint or user-agent string mid-session.
- Impossible travel: a session active in two geographically distant locations within minutes.