Session hijacking occurs when an attacker obtains, steals, or reuses a valid authenticated session, token, cookie, or similar credential to act as a user without completing a normal login flow. It differs from ordinary password theft because the attacker may rely on an already-issued session artifact rather than repeatedly entering the user’s password.
Credential Theft Versus Session Theft
Credential theft usually focuses on usernames, passwords, recovery codes, or MFA factors. Session hijacking focuses on the authenticated state that exists after a login succeeds. A browser cookie, refresh token, access token, device token, or application session may allow continued access until revoked, expired, bound to a device, or otherwise invalidated.
This is why MFA does not prevent every form of account compromise. MFA can reduce the likelihood of initial credential misuse, but if an attacker obtains a valid session artifact, they may be able to replay or reuse access without triggering the same challenge. Stronger controls such as phishing-resistant authentication, token protection, device compliance, conditional access, and session revocation can reduce risk, but each has operational limits.
How It Appears in an Investigation
In Azure & Microsoft 365 Incident Response and other cloud environments, investigators may review sign-in records, session identifiers where available, device IDs, browser user agents, IP addresses, conditional access outcomes, MFA events, token revocation activity, OAuth applications, mailbox actions, and cloud audit logs. The goal is to determine whether activity reflects the legitimate user, stolen credentials, or reuse of an authenticated session.
Evidence may include sudden geographic changes, unfamiliar devices, access without expected MFA prompts, suspicious browser fingerprints, mail actions following a token theft campaign, or cloud file activity from infrastructure unrelated to the user. Those signals should be correlated before attributing activity to session compromise.
Relationship to BEC and MFA Fatigue
Session hijacking can support business email compromise when an attacker accesses a mailbox, creates rules, reads invoice threads, or sends fraudulent payment instructions. It can also follow MFA fatigue if a user approves a malicious login and the attacker receives a valid session.
Containment Considerations
Containment may require more than a password reset. Depending on platform and evidence, responders may need to revoke sessions, rotate credentials, remove malicious OAuth grants, reset MFA methods, review trusted devices, disable forwarding, and examine mailbox and file activity that occurred before revocation.