Session hijacking has evolved from a theoretical vulnerability to one of the most effective attack methods in enterprise environments.
How Modern Session Hijacking Works
The most common methods include adversary-in-the-middle (AiTM) phishing, where the attacker creates a proxy between the user and the real login page. The user authenticates normally, completes MFA, and receives a valid session token. The attacker captures that token in transit and uses it to establish their own session.
Browser cookie theft through info-stealer malware is another growing vector. Malware running on the user's device extracts session cookies from the browser's cookie store. These cookies can be replayed from any device.
Token replay attacks exploit the fact that most session tokens have no device binding. A token stolen from one device can be used on another, and the application cannot distinguish between the two.
Why Current Defenses Miss It
MFA protects the login event. Session hijacking occurs after login. There is no MFA challenge when a stolen token is presented because the system sees an already-authenticated session.
The Salesforce/Drift breach of August 2025, documented by Google's Threat Intelligence Group, demonstrated the scale of this problem. Attackers stole login tokens from a chatbot plugin and used them to pull data from over 700 organizations for 10 consecutive days. Victims included Cloudflare, Palo Alto Networks, and Zscaler, according to Google GTIG's published analysis.
The Expanding Attack Surface
Modern enterprise sessions extend beyond human users. Persistent API tokens, automated scripts, and AI agents all maintain sessions. The OpenClaw crisis of early 2026, documented by SecurityScorecard's STRIKE team, revealed over 40,000 AI agent instances running on the open internet with no authentication (SecurityScorecard, February 2026).
The structural defense against session hijacking is continuous behavioral verification. Even when a stolen token grants access, the entity using that token behaves differently from the legitimate user.
Sources: Google Threat Intelligence Group, Salesforce/Drift breach analysis (cloud.google.com/blog/topics/threat-intelligence). SecurityScorecard STRIKE Team, OpenClaw exposure report, February 2026 (securityscorecard.com/blog). ITRC 2025 Annual Data Breach Report (idtheftcenter.org).