What Is Session Hijacking?

Definition

Session hijacking is taking over a user's already signed-in session, usually by stealing the session cookie or token a website issues after login. Because the site treats that token as proof the user already passed the password and MFA checks, an attacker who holds it can act as that user without knowing either.

How It Works

After you sign in, a web application gives your browser a session token, usually a cookie, so you do not have to sign in on every page. MITRE ATT&CK technique T1539, Steal Web Session Cookie, explains that attackers who steal these cookies can "gain access to web applications or Internet services as an authenticated user without needing credentials," and that cookies "are often valid for an extended period of time."

Common ways tokens are stolen:

Infostealer malware on a laptop copies cookies straight from the browser.
Adversary-in-the-middle phishing pages sit between the user and the real login page, pass the MFA prompt through, and keep the resulting cookie.
Vulnerable appliances or apps leak session data. Citrix Bleed (CVE-2023-4966) let attackers pull valid session cookies from NetScaler devices and, in CISA's words, "bypass password requirements and multifactor authentication."

Defenses focus on making stolen tokens less useful: shorter session lifetimes, binding sessions to a managed device, revoking all sessions after a suspected compromise, and phishing-resistant sign-in methods such as passkeys.

Real-World Example

CircleCI, a software build platform, reported in January 2023 that malware on one engineer's laptop, which was compromised on December 16, 2022, "was not detected by our antivirus software." The malware "was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location." The stolen session was "a valid, 2FA-backed SSO session." Because the engineer had privileges to generate production access tokens, the attacker reached production systems, and on December 22 took customer environment variables, tokens, and keys.

Why It Matters for a Small Business

Many small businesses rolled out MFA and reasonably assume their Microsoft 365 or Google accounts are now safe. Session hijacking goes around that check rather than through it. A single infected laptop, or one click on a convincing phishing page, can hand an attacker a live session to email, payroll, or the bank portal. Resetting the password alone may not end the attack if existing sessions stay valid. The response has to include revoking sessions, and prevention has to include device health and sign-in methods that resist phishing.

How to Spot It / How DTS Handles It

Warning signs: activity from a new country or hosting provider with no matching sign-in prompt, a session appearing on two locations at once, new inbox rules or MFA methods nobody added, and infostealer alerts on a device.

DTS can help with setting session lifetime and device-based conditional access policies in Microsoft 365, rolling out phishing-resistant MFA, and revoking all sessions as a first response step. See our Microsoft 365 security service, and for device protection, our managed IT service.

Related Terms

Account takeover: the result of a hijacked session.
MFA: bypassed when a session token is stolen.
Phishing-resistant MFA: blocks adversary-in-the-middle cookie theft.
Passkeys: sign-in that a fake page cannot relay.
Conditional access: ties sessions to trusted devices.
Phishing: a common way session cookies are stolen.
EDR: catches infostealer malware on the device.

Sources

MITRE ATT&CK, Steal Web Session Cookie, T1539: https://attack.mitre.org/techniques/T1539/
CircleCI, CircleCI incident report for January 4, 2023 security incident (January 2023): https://circleci.com/blog/jan-4-2023-incident-report/
CISA, FBI, MS-ISAC and ASD's ACSC, #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability, AA23-325A (November 21, 2023): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

Last updated October 14, 2026.