Session hijacking is an attack on the login that already happened: instead of stealing your password, the attacker steals the session cookie or token your browser uses to prove you are logged in, and replays it to take over your account as if they were you. No password guessing, no MFA prompt — the hard part of the break-in is already done, which is exactly why session hijacking defeats accounts that have multi-factor authentication switched on.
TL;DR
- Session hijacking steals the session token a browser holds after login, not the password itself.
- It defeats MFA because the attacker logs in with the session, bypassing the login flow entirely.
- Common routes: stolen cookies via infostealer malware, evil-twin Wi-Fi, session fixation, and exposed tokens in URLs.
- HTTPS everywhere, short session lifetimes, and re-authentication for sensitive actions cut the risk sharply.
- Cyber Aware training targets the malware and phishing that capture session tokens in the first place.
What is session hijacking?
When you log in to a web app, the server hands your browser a session cookie or token. Every request after that presents the token instead of the password — it is how the web remembers you are you. Session hijacking means the attacker obtains that token and presents it from their own machine: the server sees a valid session and waves them straight through.
The takeover usually ends the real session — you get logged out while the attacker keeps working — or, with stolen cookies replayed in parallel, runs silently beside you. Attackers favour sessions over passwords for one reason: passwords are protected by MFA, and session cookies are not.
How attackers steal a session
- Infostealer malware. The dominant route in 2026: information-stealing malware sweeps saved cookies from browsers — including the special cookies marked to never expire for that device — and sells them on criminal marketplaces. The buyer logs in without ever touching a password or an MFA prompt.
- Evil-twin Wi-Fi. An attacker runs a fake hotspot named after the office or cafe network and intercepts unencrypted traffic.
- Session fixation. The attacker plants a known session ID in a victim's browser before login, then uses the same ID once the victim logs in.
- Tokens in URLs. Apps that put session IDs in links leak them into browser history, referrer headers and shared messages.
- Cross-site scripting. A script injection on a vulnerable page can read cookies that are not properly protected.
Most of these routes share a dependency on human error — an installed loader, a joined hotspot, a link shared carelessly — which is why the human layer keeps showing up in the defence list.
What session hijacking costs a business
A hijacked mailbox or finance system session is indistinguishable from the real employee for as long as the token lives: invoices sent, payroll changed, customer data downloaded. Because the attacker never triggers a login event, many alerting systems never fire. The damage profile matches any account takeover, and the Australian baseline applies: the Australian Signals Directorate counted more than 84,700 cybercrime reports in 2024-25 — one every six minutes — with small business averaging $56,600 per report (ASD Annual Cyber Threat Report 2024-25).
There is also a replay dimension: infostealer logs circulate for months, so a session captured from one employee's laptop can be sold and reused long after the original infection is cleaned.
Signs of a hijacked session
- You are logged out of an account unexpectedly, or a platform shows "signed in from a new device" you do not recognise.
- Sessions listed in account settings from unfamiliar locations or operating systems.
- Security warnings about sign-ins even though nobody typed a password.
- Colleagues receiving messages from you that you did not send.
Any one of these justifies ending all sessions immediately and rotating credentials.
How to prevent session hijacking
- Force HTTPS everywhere and enable HSTS so tokens never cross the network unencrypted.
- Bind sessions to the device where the platform supports it: device-bound cookies and passkeys make a stolen token useless on another machine.
- Short session lifetimes and rotation — re-issue tokens after login and privilege changes, and expire idle sessions.
- Require re-authentication for sensitive actions — approving a payment, changing bank details, exporting customer data.
- Deploy passkeys or hardware security keys where the platform supports them; passkeys cannot be replayed from a stolen cookie jar.
- Keep infostealers out: endpoint protection, prompt patching, and staff training on the loaders and lures that deliver them.
- Never put session IDs in URLs, and mark cookies Secure, HttpOnly and SameSite.
Where the human layer fits
The two most common capture routes in 2026 — infostealer infections and fake hotspots — both start with a person's decision. Awareness training is what closes them. Cyber Aware delivers security awareness training monthly, simulates the phishing that installs token-stealing malware, and auto-enrols anyone who clicks into remediation the same day. If you need to evidence these controls for Essential 8, SMB1001 or an insurer, a cyber security gap assessment shows what is already covered and what to close next.
FAQ
What is session hijacking in simple terms? Stealing the digital wristband that proves you are logged in, instead of the password. The attacker wears your session and the system cannot tell the difference.
How is session hijacking different from credential theft? Credential theft captures a password and still has to pass login — and MFA. Session hijacking skips the login entirely by reusing a valid token, which is why it defeats MFA.
Does MFA prevent session hijacking? No — and that is the uncomfortable truth in 2026. MFA protects the login event; a stolen session cookie bypasses the login. Device-bound sessions, passkeys and short token lifetimes are the mitigations.
How do attackers get session cookies? Mostly information-stealing malware that harvests saved cookies from infected browsers, plus fake Wi-Fi networks, cross-site scripting and tokens accidentally exposed in URLs.
What should I do if I suspect a hijacked session? Sign out everywhere from the account's security settings, change the password from a clean device, review active sessions and mailbox rules, and scan the devices you use.
What are session tokens used for? They let a web app remember that an already-authenticated user is authenticated, so the password does not travel with every request. Stealing that token is stealing the logged-in state itself.
One last thing
Check which of your critical systems offer passkeys or hardware-key support and switch the highest-risk accounts — finance, admin consoles, email — first. A session token stolen from a browser can be replayed within minutes on criminal marketplaces; a passkey tied to the device physically cannot leave it. That single change removes the entire replay economy in 2026.
Related guides
- Phishing simulations and protection — stop the loaders that harvest session tokens.
- Human risk reporting — measure who reports and who clicks, monthly.