What Is Session Hijacking?

Session hijacking is the theft and reuse of the token a website issues after a successful login, letting an attacker act as the authenticated user without ever supplying a password or a second factor. Once a session cookie or token is in hand, it is functionally indistinguishable from the real thing: the server sees a request carrying valid credentials and serves it, whatever actually sent that request. The attack's defining property is what it skips: it does not attack authentication at all, it attacks what authentication produces, which is why a perfectly implemented login flow can still leave the door open behind it.

How the token gets stolen

Malware is the most direct route: infostealers harvest browser cookie stores wholesale, and stolen-session listings now trade alongside stolen passwords in the same underground markets, priced by which accounts the cookies unlock. Cross-site scripting lifts tokens by running attacker script in the victim's browser session, most damaging on sites that never sanitize user input. Network-level interception, sniffing unencrypted traffic on public Wi-Fi, has faded as HTTPS became universal, but it remains a live risk for misconfigured internal or legacy systems. And adversary-in-the-middle phishing proxies produce the same outcome from the opposite direction: rather than stealing a session that exists, they relay a live login and capture the session the moment it is minted, the technique behind much of what MFA bypass accomplishes against otherwise well-defended logins.

Why it defeats strong authentication

Passwords, two-factor authentication, and even passkeys all prove identity at one moment: the moment of login. None of them re-verify continuously afterward, and session hijacking exploits exactly that gap by acquiring the proof of an event it never participated in. This is the sharpest reason phishing-resistant authentication is necessary but not sufficient: a passkey stops an attacker from acquiring a session through a fake login page, but does nothing once a session already exists and its token is lifted from a compromised device by other means.

Shrinking the window

Because the token's value comes from what it grants, the durable defenses shrink either its lifetime or its portability. Short-lived, frequently rotated sessions with re-authentication for sensitive actions reduce how much a stolen token is worth. Binding tokens to device fingerprint or network context so a session captured on one machine fails on another closes the "just copy the cookie" path outright. Anomaly detection, a session suddenly acting from a new geography, device, or behavioral pattern, can force re-verification mid-session, an application of the same behavioral analysis used to catch bots before login. And since a large share of session theft begins with malware or phishing infrastructure delivered through automated campaigns, keeping bot traffic away from login and account-recovery flows, where CaptchaFox verifies a human is present before a session is even minted, closes off one of the pipelines feeding the theft in the first place.