Session hijacking is an attack in which an attacker takes over a user’s authenticated session by stealing or forging the session token, gaining access without knowing the password.
How session hijacking works
After you log in, a website gives your browser a session token, usually stored in a cookie, so that you do not have to re-enter your password on every page. Whoever presents that token is treated as you. Attackers obtain it in several ways:
- Cookie theft by malware – infostealers copy browser cookies, which criminals sell and import into their own browsers (“pass-the-cookie”).
- Adversary-in-the-middle phishing – kits such as Evilginx proxy the real login page and capture the session cookie after the user completes MFA.
- Cross-site scripting – injected scripts read cookies that are not protected.
- Man-in-the-middle interception on unencrypted connections.
- Session fixation – forcing a victim to use a session ID the attacker already knows.
Why it matters
A stolen session bypasses passwords and even two-factor authentication, because the login has already happened. Session theft has become a key technique for taking over cloud, email and social media accounts – including high-profile YouTube channels – and is a common first step in business email compromise.
How to prevent session hijacking
- Developers: set cookies with Secure, HttpOnly and SameSite flags, rotate session IDs after login and expire sessions.
- Bind sessions to the device – for example Chrome’s Device Bound Session Credentials – and re-check risky actions.
- Use phishing-resistant authentication (passkeys) that does not work through proxy pages.
- Users: protect devices from infostealers and log out of sessions you do not recognise.
Synonyms:
session hijack, cookie hijacking
