Session Hijacking
The theft or forgery of a valid session token or cookie, letting an attacker impersonate an already logged-in user without ever needing their password.
Definition
Session hijacking is an attack in which a criminal steals or forges the session token or cookie a website issues to a user after they successfully log in, then uses that token to impersonate the user without ever needing their username or password. Because the session token represents an already-authenticated session, possessing it is often just as good as, or better than, having the victim's credentials, since it typically bypasses any login screen and any multi-factor authentication challenge entirely.
Attackers obtain session tokens through several routes: malware on the victim's device that reads browser cookies directly, cross-site scripting vulnerabilities on a legitimate website that let an attacker's script exfiltrate a visitor's session cookie, unsecured public Wi-Fi where traffic can be intercepted, or increasingly, adversary-in-the-middle phishing kits that relay an entire login and capture the resulting session cookie in real time. Once obtained, the attacker loads the stolen token into their own browser, often using a browser extension or simple cookie-editing tool, and the target application treats them as the legitimate, already-logged-in user.
Session hijacking matters because it sidesteps the defenses organizations rely on most: strong passwords and multi-factor authentication both protect the login step, but a hijacked session has already passed that step by the time the attacker uses it. This makes it a favored technique against high-value webmail and SaaS accounts, since a hijacked corporate email session can be used to read confidential correspondence, set up mail-forwarding rules, or launch business email compromise fraud, all while looking like ordinary activity from the account owner.
Defense centers on shrinking the value and lifetime of a stolen session: short session timeouts, binding sessions to the device or IP address where they were issued, and continuous risk-based re-authentication all limit what an attacker can do even with a valid token. Enforcing HTTPS everywhere prevents interception over unsecured networks, and monitoring for a session suddenly being used from an implausible new location or device allows security teams to revoke it quickly. Because adversary-in-the-middle phishing is now a major source of hijacked sessions, phishing-resistant authentication remains a critical upstream defense as well.
At a glance
- Severity
- High
- Prevalence
- Common
- Primary targets
- Webmail, SaaS, and web application sessions
- Also known as
- Cookie hijacking, token theft
How it works
- 1
Token capture: an attacker obtains a victim's session cookie or token through malware, cross-site scripting, unsecured Wi-Fi interception, or an adversary-in-the-middle phishing proxy.
- 2
Token replay: the attacker loads the stolen token into their own browser or tool, presenting it to the target application as proof of an already-authenticated session.
- 3
Impersonation: the application accepts the token and treats the attacker as the legitimate, logged-in user, skipping the login screen and any MFA challenge.
- 4
Silent access: the attacker browses, reads data, or changes settings while appearing to the system as the normal account owner.
- 5
Escalation: a hijacked corporate email or SaaS session is often used to set up persistence, such as forwarding rules, or to launch further fraud.
Warning signs
- An active-sessions or sign-in-activity list showing a device, browser, or location you do not recognize
- Being unexpectedly logged out of an account, which can happen when an attacker's use of a stolen session conflicts with yours
- Unfamiliar inbox rules, forwarding settings, or sent messages you did not create
- Security alerts about a session accessed from an implausible or new location shortly after using public Wi-Fi
- Application activity or changes you do not recall making while logged in
How to defend
- Enforce HTTPS everywhere so session tokens cannot be intercepted over the network
- Set short session and token lifetimes, requiring re-authentication for sensitive actions
- Bind sessions to the originating device or IP address and flag or block use from a different context
- Deploy phishing-resistant MFA to reduce the supply of sessions captured through adversary-in-the-middle kits
- Regularly review active sessions and revoke any that look unfamiliar
- Avoid using sensitive accounts over unsecured public Wi-Fi, or use a trusted VPN when doing so
Real-world example
An employee checks their corporate webmail over a hotel's open Wi-Fi network. An attacker on the same network intercepts the unencrypted session cookie and loads it into their own browser, gaining full access to the mailbox without ever seeing a password or MFA prompt, since the session was already authenticated.
How Claro helps
Claro's phishing simulations and JIT training cover the lookalike-login scenarios that feed session hijacking through adversary-in-the-middle kits, while risk scoring flags accounts showing signs of anomalous session activity, giving Indonesian security teams an evidence-based way to prioritize where to tighten session controls first.
Frequently asked questions
What is Session Hijacking?
Session hijacking is an attack where a criminal steals or forges the session token that keeps you logged in, letting them take over your active session without needing your password.
Is session hijacking the same as stealing a password?
No. Session hijacking steals the token issued after a successful login rather than the password itself, which means it bypasses the login screen and any multi-factor authentication entirely for as long as the token remains valid.
How can an attacker steal a session token?
Common methods include malware that reads browser cookies, cross-site scripting flaws on a website, interception over unsecured public Wi-Fi, and adversary-in-the-middle phishing kits that relay a login in real time and capture the resulting session.
Does changing my password stop a session hijack in progress?
Often, yes, since many services invalidate active sessions when the password changes, but it is not guaranteed everywhere. Reviewing and manually revoking active sessions is a more reliable step after suspected hijacking.
Can multi-factor authentication prevent session hijacking?
MFA protects the login step, but a hijacked session has already passed that step, so MFA alone does not stop it. Short session lifetimes, device binding, and phishing-resistant login methods are more directly effective.
Related terms
Adversary-in-the-Middle (AiTM) Phishing
A real-time phishing technique that uses a proxy server to relay a victim's login between them and the real website, stealing the session cookie and bypassing most multi-factor authentication.
Account Takeover
When an attacker gains unauthorized control of a user's online account, typically through stolen credentials, and uses it for fraud or further attacks.
Malware
Any software intentionally designed to damage, disrupt, or gain unauthorized access to a device or network.
Reduce your human risk
Claro measures and lowers the risk these terms describe, in English and Bahasa Indonesia.
Request a demo