Session Hijacking: Threats and Prevention

Session hijacking refers to cyberattack techniques that let adversaries take over active, authenticated user sessions by obtaining valid session identifiers such as cookies, tokens, URL parameters, or POST data. Also known as cookie theft, it has increased in prevalence and is used both by APT actors for credential access, lateral movement, and collection, and by fraudsters to access victims’ resources for theft, reputational harm, or other abuse. Because attackers act with legitimate tokens, these attacks often bypass MFA and evade common detection signals like failed logins, making User Behavioral Analysis (UBA) one of the most effective detection approaches. Prevention is emphasized as the preferable strategy, though some controls can create user friction.

Multiple execution methods are described: network eavesdropping/side-jacking via packet sniffing (especially on unsecured public Wi‑Fi), brute forcing weak or predictable session IDs, XSS-based token theft from browser cookies, info-stealer malware capturing cookies or OAuth tokens when credentials aren’t available, and session fixation that coerces a known session ID. Real-world incidents illustrate impact: stolen Slack employee tokens were used to access private GitHub repositories via a third-party vendor compromise; Okta session tokens were obtained from HAR files and then used to target Okta customers (with BeyondTrust first reporting), and attackers also targeted 1Password and Cloudflare in a supply-chain pattern; CircleCI was breached when an engineer’s OAuth token was captured by info-stealer malware, enabling MFA bypass. Tokens and cookies are also sold on dark web markets, and frameworks like Evilginx and Muraena lower the skill barrier. With SaaS usage widespread, stolen live cookies and tokens are positioned as an ongoing primary vector for enterprise compromise, motivating layered mitigations from secure coding and patching through advanced measures like mTLS, TLS channel binding, and IAM-integrated UBA/ITDR workflows.

• Session hijacking can use valid session identifiers from URL parameters, POST data, cookies, or tokens to take over authenticated sessions.
• Session hijacking is also referred to as cookie hijacking or cookie theft.
• Session hijacking techniques are often used to bypass Multi-Factor Authentication (MFA).
• User Behavioral Analysis (UBA) is identified as a leading method for detecting session hijacking.
• A January 16, 2025 Executive Order directed NIST and CISA to develop guidelines for secure management of access tokens and cryptographic keys used by cloud service providers.
• Network eavesdropping (side-jacking) can capture session data with packet sniffers, especially on unsecured networks.
• Cross-Site Scripting (XSS) can be used to steal session tokens stored in browser cookies.
• In December 2022, Slack reported stolen employee tokens were used to access private GitHub repositories, while the primary codebase and customer data were not touched.
• In September 2023, attackers obtained valid Okta session tokens from HAR files and used them to attempt intrusions into Okta customers.
• CircleCI was breached after an engineer’s OAuth token was captured by info-stealer malware, enabling MFA bypass.

• “Once an attacker has a valid cookie or token, they can impersonate users on websites and in applications.”
• “If the cookie or token is legitimate, detecting session hijacking can be difficult.”
• “Detecting session hijacking can be hard since the bad actor’s actions usually do not set off alarms, such as failed login attempts.”
• “Preventing it is the most desirable approach.”
• “Some tactics for session hijacking prevention, however, may encumber users considerably.”
• “Public Wi‑Fi access points are frequently targeted and are thus risky.”
• “Session tokens and cookies are for sale on the Dark Net.”
• “Open-source attack frameworks like Evilginx and Muraena make it easy for adversaries who are not very technical to launch session hijacking attacks.”
• “Given the prevalence of using SaaS apps today, session hijacking will likely continue to be a leading vector for enterprise compromises.”
• “Attackers only need to get hold of live cookies and tokens to do a lot of damage.”