Skip to main content
Threat playbook

Category: Account & Session Attacks

Session hijacking and cookie theft

Session hijacking reuses your signed-in session without your password. Attackers often steal the session cookie.

Infostealer malware and phishing relay kits are common sources. A stolen cookie can bypass MFA. If you suspect theft, sign out everywhere. Then change your password.

The attacker never signs in. They replay a session that already passed MFA.

Updated 2026-10-30

How do attackers steal session cookies?

MITRE T1539 covers stealing web session cookies. Cookies sit on disk, in browser memory, and in traffic. Microsoft's Lumma Stealer analysis found it taking browser cookies.

Account takeover paths and the controls that stop them. Sources: MITRE, Microsoft, OWASP, and OWASP on credential stuffing.
PathHow it worksWhat stops it
Infostealer malwareMalware copies cookies and saved passwords from the browserAvoid cracked software. Revoke sessions after any infection.
Adversary-in-the-middle phishingA relay page passes your sign-in to the real site and keeps the cookiePasskeys or security keys. See fake login pages.
Malicious extensionAn extension reads cookies or injects scripts into pagesRemove extensions you do not need. See malicious browser extensions.
Session fixationThe attacker plants a session ID before you sign inSites issue a new session ID at sign-in
Credential stuffingNot session theft: bots replay breached passwords at sign-inUnique passwords and MFA. See missing API rate limiting.

Account takeover paths and the controls that stop them. Sources: MITRE, Microsoft, OWASP, and OWASP on credential stuffing.

How does session hijacking work?

  1. You sign in, and the site sets a session cookie.
  2. Malware, a bad extension, or a relay page copies it.
  3. The attacker loads the cookie into another browser.
  4. They act fast: inbox rules, new OAuth apps, API keys.

Can session hijacking bypass MFA?

MFA checks you at sign-in. A stolen cookie skips sign-in entirely. MITRE notes session cookies can bypass some MFA protocols.

Microsoft's AiTM research showed relay kits stealing cookies after MFA. Fraud began as soon as five minutes later.

Passkeys resist relay phishing. They do not stop malware stealing cookies later.

Google built Device Bound Session Credentials for this risk. Google calls it DBSC. It binds sessions to a key stored on the device. Stolen cookies then expire quickly and stop working. It reached Windows users on Chrome 146 in April 2026. Google said macOS would follow. Each site must add support.

What should you do if your session was hijacked?

  1. Sign out of all sessions from the real site.
  2. Change your password and any you reused.
  3. Revoke app passwords, tokens, and unknown OAuth apps.
  4. Check MFA methods and recovery details.
  5. Look for new mail forwarding or inbox rules.
  6. Scan the device if malware is possible.
  7. Teams: revoke sessions centrally and rotate API keys.

What is session fixation?

Session fixation plants a known session ID before sign-in. A site that keeps it after login shares your session. OWASP says sites must issue a new ID at login. Site builders fix this, not users.

Why do login defenses miss session theft?

  • MFA runs at sign-in, and replay skips sign-in.
  • Actions taken with a valid session look legitimate.
  • Users see no password alert or new login prompt.

How do security teams detect and contain stolen sessions?

  • Alert on sessions reused from a new device.
  • Watch for new inbox rules, OAuth grants, and API keys.
  • Require re-authentication for MFA changes and payments.
  • Shorten session lifetimes for admin roles.
  • Block unapproved extensions with browser policy.
  • Keep a session reset runbook ready.

Where does browser isolation fit?

  • Shield opens a page in an isolated browser off your device.
  • Shield destroys that browser when you close the tab.
  • Cookies saved in your own browser remain a separate risk.
  • Isolation does not remove malware already on your device.
Add to Chrome

Limits

  • DBSC protects only sites that add support.
  • Detection signals vary by identity provider.
  • Sources were checked on October 30, 2026.
  • Legba publishes this guide. Shield is part of Legba's Chrome extension.

What to do next

Treat a stolen session like a stolen password. Revoke sessions first. Then fix how the cookie was taken.

FAQs.

Can session hijacking bypass MFA?
Yes, a stolen session cookie was issued after MFA. Replaying it skips the login step.
Is this the same as cookie theft?
Cookie theft is a common way to hijack a session. Other tokens, such as bearer tokens, work too.
How do attackers use stolen browser cookies?
They load the cookie into another browser. The site treats them as you. Then they add persistence, like inbox rules or app grants.
How do security teams detect stolen session cookies?
Watch for sessions reused from a new device. Flag new inbox rules, OAuth grants, and API keys.
Is credential stuffing the same as session hijacking?
No, credential stuffing replays breached passwords at the login page. Session hijacking skips login with a stolen session.
What is the fastest response?
Revoke all sessions and tokens. Then change passwords and remove any persistence.
Does a passkey stop session hijacking?
It resists relay phishing. It does not stop malware stealing cookies later.

References

  1. 01
    MITRE ATT&CK: Steal Web Session Cookie (T1539)MITRE
  2. 02
    MITRE ATT&CK: Browser Session Hijacking (T1185)MITRE
  3. 03
    Microsoft: From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraudMicrosoft
  4. 04
    Microsoft: Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealerMicrosoft
  5. 05
    Google: Protecting Cookies with Device Bound Session CredentialsGoogle
  6. 06
    OWASP Cheat Sheet Series: Session ManagementOWASP
  7. 07
    OWASP Cheat Sheet Series: Credential Stuffing PreventionOWASP

Keep exploring

Try it on the next page you do not trust

Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.

Add to Chrome

Free for 30 days. No card required.

Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.