Session Hijacking
Stealing a valid session, commonly via a captured session cookie or token, to impersonate a user and bypass MFA. Mitigated by token binding, short lifetimes, and DPoP.
Session theft is the dominant way MFA gets bypassed today, because the attacker never authenticates: they arrive holding a session that already did. That is also why the incident response is different, since resetting the password leaves the stolen session alive. Revoke sessions and refresh tokens explicitly, and consider device-bound or sender-constrained sessions so a lifted cookie is useless elsewhere.
See also: token theft, account takeover, DPoP, infostealer session hijacking teardown, pass-the-cookie
Related on Start with Identity
- GlossaryConsent Phishing (Illicit Consent Grant)
Consent phishing, which Microsoft calls an [illicit consent grant](https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-illicit-consent-gr
- GlossaryInfostealer
Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-the
- GlossaryDevice Bound Session Credentials (DBSC)
Device Bound Session Credentials (DBSC) is a web standard that binds a browser session to a private key held in the device's hardware, so a session cookie stole
- BlogA hijacked AI coding assistant session spread Shai-Hulud to about 100 internal repositories
Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stol
- BlogA shared ChatGPT link could read the victim's session token and private chats, Parameter says
Parameter disclosed on October 28 a chain that let a shared ChatGPT conversation run script as chatgpt.com, read the viewer's session token and call ChatGPT's A
- BlogAkeyless ships Runtime Authority, authorising AI agents per action instead of per session
Agents hold no secrets and get no standing privilege. Every action is authorised at the moment it happens, and the audit trail links the originating prompt to t