Blog · 3 posts
#session-hijacking
- News · Oct 22, 2026Huntress tracks stolen-session replay into 79 Microsoft 365 organizations without a password
Huntress reported on October 22 that one actor replayed tokens stolen by AiTM and device-code phishing into 79 organizations between July 14 and September 22, registering rogue Entra devices and swapping MFA methods within hours to survive password resets.
- News · Sep 17, 2026Gyazo breach exposes 23.6 million accounts, including session IDs and X integration tokens
An attacker reached Gyazo's database through its image upload server and took 23.62 million user records: emails, password hashes, login session IDs, device IDs and X integration tokens, plus 490 million image metadata records.
- News · Aug 30, 2026Infostealers are draining Claude subscriptions with stolen session cookies, no password needed
Anthropic warned that commodity infostealers are lifting Claude session cookies from browsers and replaying them to drain paid usage. No password, no MFA prompt, and signing the user out stops the session without removing the malware.