Session Hijacking
Stealing a valid session, commonly via a captured session cookie or token, to impersonate a user and bypass MFA. Mitigated by token binding, short lifetimes, and DPoP.
Session theft is the dominant way MFA gets bypassed today, because the attacker never authenticates: they arrive holding a session that already did. That is also why the incident response is different, since resetting the password leaves the stolen session alive. Revoke sessions and refresh tokens explicitly, and consider device-bound or sender-constrained sessions so a lifted cookie is useless elsewhere.
See also: token theft, account takeover, DPoP, infostealer session hijacking teardown
Related on Start with Identity
- GlossaryInfostealer
Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-the
- GlossaryDevice Bound Session Credentials (DBSC)
Device Bound Session Credentials (DBSC) is a web standard that binds a browser session to a private key held in the device's hardware, so a session cookie stole
- GlossaryBearer Token
A bearer token is a credential that grants access to whoever presents it, with no proof that the presenter is the party it was issued to. OAuth 2.0 defines how
- BlogA hijacked AI coding assistant session spread Shai-Hulud to about 100 internal repositories
Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stol
- BlogAkeyless ships Runtime Authority, authorising AI agents per action instead of per session
Agents hold no secrets and get no standing privilege. Every action is authorised at the moment it happens, and the audit trail links the originating prompt to t
- CVECitrix Bleed, session-token leak from NetScaler ADC
A buffer over-read on NetScaler ADC/Gateway leaked session tokens in the clear. Attackers replayed them and skipped the login, including MFA. CISA KEV. October