Short answer: Session hijacking is when an attacker steals the token your browser holds after you log in — the cookie that says “this person is already authenticated” — and replays it from their own machine. They skip the login screen entirely, which means your password and your 2FA code are never requested. It is how most “but I had two-factor enabled!” account takeovers actually happen.
Why sessions exist at all
Websites cannot ask for your password on every click. So when you log in successfully, the server issues a session token and your browser stores it as a cookie. Every subsequent request carries that token, and the server treats it as proof you already proved yourself.
That is a sensible design. It is also a single object that represents your entire authenticated identity — and unlike a password, it does not require anything else to be useful.
Steal the token, become the user. No credentials needed.
How tokens get stolen
Infostealer malware (by far the most common)
A family of malware that does one job: sweep a computer for browser cookies, saved passwords, crypto wallet files and authentication tokens, then upload them. The harvested data is sold in bulk, often within hours.
How it arrives: cracked software, game cheats and mods, fake installers for popular apps, malicious browser extensions, and — increasingly — attachments in sponsorship or job-offer emails aimed at creators and developers.
This is why gaming, streaming and freelance accounts are hit so hard. The malware arrives dressed as something the target actively wanted.
Malicious browser extensions
An extension with permission to read page data can read your session cookies. Extensions get sold to new owners and quietly updated with new behaviour, so one you installed years ago from a reputable developer is not permanently safe.
Real-time phishing that captures the session
Modern phishing kits do not just collect your password and code — they proxy your entire login and keep the resulting session cookie. You end up genuinely logged in and never suspect anything, while the attacker holds an identical session. Covered in can 2FA be hacked?
Physical access
An unlocked laptop for two minutes is enough to export cookies or install something. Less exotic than malware, and more common than people assume in shared offices and homes.
Cross-site scripting
A vulnerability in the website itself that lets an attacker run script in your browser and read cookies. Less common now — proper cookie flags mitigate it — and it is the site’s job to fix, not yours.
Why 2FA does not help
This is the part worth internalising: authentication happens once, at login. Everything after that is the session.
Your authenticator app, your security key, your passkey — all of them are consulted at the door. A stolen session token means the attacker never approaches the door. They are already inside, holding a wristband that says they were checked.
Even passkeys, which are otherwise the strongest option available, do not change this. Phishing resistance protects the login; it does nothing about a session that was legitimately created and then stolen. See phishing-resistant MFA for where that boundary sits.
Signs your session has been hijacked
- Sessions or devices you do not recognise in an account’s security page.
- Being signed out unexpectedly, or finding settings changed.
- Messages, posts or emails sent from your account that you did not write.
- Login alerts from unfamiliar locations without any 2FA prompt reaching you — a strong signal, because it means no login occurred.
- New forwarding rules, recovery addresses or connected apps you did not add.
How to protect yourself
Since 2FA is not the control here, the defences are different:
- Do not run untrusted software. Cracked apps, game cheats, “free” versions of paid tools and unsolicited attachments are the primary delivery mechanism. This single habit prevents most cases.
- Audit browser extensions. Remove what you do not use, and be sceptical of extensions requesting access to all sites.
- Keep your OS and browser updated. Patches matter.
- Sign out of sessions you are not using, especially on shared or old devices. Most services have a “where you’re logged in” page — use it periodically.
- Lock your devices. Short auto-lock timers, full-disk encryption, and never leaving a laptop unlocked in a shared space.
- Use separate browser profiles for work, personal and anything risky. It compartmentalises the damage.
- Watch for the follow-up moves — check email forwarding rules and connected apps regularly, since those persist after the session is gone.
If you think it has happened
- Get off the compromised device. Use a different, clean machine for the next steps — otherwise you are handing over the new credentials too.
- Change the password on the affected account. On most services this invalidates existing sessions, which is the point.
- Sign out all sessions explicitly from the account’s security page.
- Check recovery details, forwarding rules and connected apps for anything added.
- Re-enrol 2FA and remove devices or methods you do not recognise.
- Clean or rebuild the infected machine. Removing the malware matters more than any of the above, because without it you will simply be reinfected. A full reinstall is the reliable option.
- Then repeat for other accounts that were logged in on that device. Infostealers take everything, not one thing.
Frequently asked questions
Can session hijacking be prevented entirely?
Not entirely, but the delivery mechanisms are avoidable. Sites also help — binding tokens to device characteristics, expiring sessions, and detecting impossible travel. Newer standards for device-bound session credentials aim to make stolen cookies useless off the original machine.
Does logging out protect me?
Yes, and it is underrated. A session that has been ended cannot be replayed. Logging out of sensitive accounts on shared or rarely used devices is genuinely worthwhile.
Do passkeys stop this?
No. They stop phishing at the login step. Once a session exists, it can be stolen regardless of how it was created.
Is public Wi-Fi how this happens?
Rarely now. HTTPS is near-universal, so network sniffing of cookies is largely historic. Malware on your own machine is the realistic threat.
How long do stolen sessions last?
Anywhere from hours to months, depending on the service. Long-lived sessions are convenient and dangerous in equal measure — which is why shorter forced re-authentication is a sensible setting on work tools like Slack.
Should I stop using 2FA then?
Absolutely not. 2FA stops credential stuffing and phishing, which are far more common. Session hijacking is a different attack requiring a different defence — you need both.
The bottom line
Session hijacking is the reason “I had 2FA” is sometimes not the end of the story. The token issued after login is a second, quieter credential, and malware on your own machine is how it usually leaves. Keep untrusted software off your devices, sign out of what you are not using, and if you ever suspect an infection, clean the machine before you change a single password.
Want the full picture of what 2FA does and does not cover? Read can 2FA be hacked? and the 9 most common 2FA mistakes.
3 Responses