Session hijacking
Stealing the cookie or token that keeps an authenticated session open. It grants entry without a password and without a second factor.
Full definition
Session hijacking is taking over an already authenticated session by stealing the cookie or token that keeps it open. Because authentication already happened, the attacker gets in without needing the password or the second factor: the system treats them as the victim.
Cookies are stolen mainly by infostealer malware, which extracts them from the browser along with saved passwords, and by adversary-in-the-middle attacks that capture the session during a login on a fake page. Infostealer logs sold on the dark web include valid cookies precisely because they allow MFA to be bypassed.
Defenses include short expiration times for sensitive sessions, binding sessions to devices, automatic revocation upon signs of compromise, and monitoring that detects when an employee's cookies appear for sale.
Related terms
Infostealer
Malware that silently steals credentials, cookies and browser data, packaging them for sale on the dark web as stealer logs.
Multi-factor authentication (MFA)
Identity verification with two or more independent factors. It makes a stolen password insufficient, though not invulnerable.
Account takeover (ATO)
Taking control of a legitimate account with stolen credentials. From inside, the attacker reads, impersonates and escalates without raising alarms.
From definition to data: measure your company's human risk
Fensivo detects leaked credentials, simulates real attacks and validates with retests that behavior changed.