Glossary
Session hijacking is an attack in which a criminal steals or takes over a user’s active authenticated session (typically by stealing the session token or cookie) allowing them to impersonate the user without ever knowing their credentials or passing login. It sidesteps authentication entirely by riding a session the system has already trusted.
This is a crucial and often underappreciated attack, because it defeats even strong authentication. It doesn’t matter how robust your login is (MFA, passkeys, biometrics) if an attacker can steal the session that login produced.
When a user logs in, the server issues a session token (often stored as a cookie) that the browser presents on subsequent requests so the user doesn’t re-authenticate for every action. If an attacker obtains that token, they can present it themselves and be treated as the authenticated user. Common methods include stealing cookies via malware on the victim’s device, capturing tokens through adversary-in-the-middle phishing proxies, cross-site scripting (XSS) that exfiltrates tokens, and intercepting unencrypted traffic. Increasingly, "session token theft" is how attackers bypass MFA. They let the user complete MFA, then steal the resulting session.
The session token represents an already-authenticated state. Authentication (including MFA) happens once, at login, to create that session; after that, the token is trust. Steal the token and you inherit the trust, having skipped the authentication entirely. This is why "we have MFA" is not a complete answer to account takeover: session hijacking is specifically the attack that renders point-in-time authentication insufficient.
Because the compromise happens after login, only ongoing evaluation catches it. Continuous authentication and session monitoring watch for signs that the session has been taken over: a sudden change in device or network mid-session, behavioral signals that no longer match the user, or activity inconsistent with the established session. When those signals fire, the system can invalidate the session, force re-authentication, or block sensitive actions. Binding tokens to the device and using short-lived, properly-scoped tokens also limits the value of a stolen one. Fundamentally, session hijacking is why authentication has to be treated as continuous, not a one-time gate.
Beyond continuous monitoring, defenses include hardening against the theft vectors (malware protection, guarding against XSS, enforcing encrypted connections, and using secure, HttpOnly cookies) plus token binding and sensible session lifetimes. For high-value actions, re-verifying within a session (step-up) ensures a hijacked session can’t move money. The combination of making tokens hard to steal and detecting when a session is behaving wrongly is what closes this gap.
What is session hijacking?
Stealing a user’s authenticated session token to impersonate them without knowing their credentials or passing login.
How does session hijacking bypass MFA?
MFA happens at login to create the session; stealing the resulting token inherits the already-authenticated state, skipping authentication.
How is session hijacking detected?
Through continuous authentication and session monitoring: spotting mid-session changes in device, network, or behavior.
How do you prevent session hijacking?
Continuous evaluation, token binding, short-lived tokens, protection against malware and XSS, encryption, and step-up for sensitive actions.
Does strong login prevent session hijacking?
No, session hijacking steals the session created after login, so even MFA or passkeys don’t stop it; continuous monitoring is required.
Related: Continuous Authentication · Account Takeover (ATO) · Phishing · Device Takeover · Multi-Factor Authentication (MFA)
