#session-hijacking

DreamHost's breach notice, filed with California's attorney general, says an attacker who exploited its web File Manager captured the FTP/SFTP credentials of everyone who logged in from about August to October 23, 2026, and may have exposed webmail session data, emails and files.

Vercel is gradually rolling out Device Bound Session Credentials for vercel.com sign-ins, so a stolen session cookie stops working away from the device that holds the key. It works only in Chrome on Mac and Windows for now, and DPoP for the Vercel CLI is in progress.

Parameter disclosed on October 28 a chain that let a shared ChatGPT conversation run script as chatgpt.com, read the viewer's session token and call ChatGPT's APIs as them, including pulling private chats. OpenAI fixed it by October 26 and paid a $5,000 bounty.

Huntress reported on October 22 that one actor replayed tokens stolen by AiTM and device-code phishing into 79 organizations between July 14 and September 22, registering rogue Entra devices and swapping MFA methods within hours to survive password resets.

An attacker reached Gyazo's database through its image upload server and took 23.62 million user records: emails, password hashes, login session IDs, device IDs and X integration tokens, plus 490 million image metadata records.

Anthropic warned that commodity infostealers are lifting Claude session cookies from browsers and replaying them to drain paid usage. No password, no MFA prompt, and signing the user out stops the session without removing the malware.