Full Report
See how session hijacking reshaped cyber threats. Learn how stolen tokens enable rapid breaches, bypass security, and impact enterprise protection.
Analysis Summary
# Tool/Technique: Session Hijacking (Token Theft & Replay)
## Overview
Session hijacking is a technique where attackers steal active authentication tokens or cookies from a user's browser to gain unauthorized access to web applications and cloud services. By replaying these tokens, attackers bypass the need for usernames, passwords, and multi-factor authentication (MFA), appearing to the service as a pre-authenticated, legitimate user.
## Technical Details
- **Type:** Technique / Infostealer Malware / Phishing-as-a-Service (PhaaS)
- **Platform:** Web Browsers (Chrome, Edge, Firefox), Cloud Environments (Microsoft 365, Slack, Developer Platforms)
- **Capabilities:** MFA bypass, credential theft, persistent access, automated session replay.
- **First Seen:** Historically relevant, but seen a significant resurgence in sophistication and commercialization between 2020 and 2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing]
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- [T1528 - Steal Application Access Token]
- **[TA0004 - Privilege Escalation]**
- [T1550.004 - Use Alternate Authentication Material: Web Session Cookie]
- **[TA0005 - Defense Evasion]**
- [T1550 - Use Alternate Authentication Material]
## Functionality
### Core Capabilities
- **Authentication Bypass:** Skips the login page and MFA prompts by providing a valid, pre-existing session identifier.
- **Persistence:** Maintains access as long as the session remains active, even if the user changes their password.
- **Data Harvesting:** Extraction of browser cookies, stored credentials, and "fingerprint" data via infostealer malware.
### Advanced Features
- **Device Code Phishing:** Using kits like **Kali365** or **Octopi365** to trick users into authorizing a device via a code, granting the attacker a token that survives MFA.
- **ConsentFix:** Exploiting OAuth application permissions to gain long-term access to tenant data without needing a password.
- **Browser Fingerprinting:** Bundling stolen tokens with the victim's browser metadata to evade security checks that look for hardware or location mismatches.
## Indicators of Compromise
- **File Names:** `Login Data`, `Cookies` (Targeted browser files).
- **Network Indicators:**
- `tencent-cloud[.]com` (Associated with Kali365 infrastructure).
- `kali365[.]io` (Defanged PhaaS domain).
- **Behavioral Indicators:**
- Simultaneous logins from geographically distant locations.
- Multiple active sessions for a single user using different browser fingerprints.
- Creation of unauthorized OAuth applications or "Consent" grants.
- Unexpected browser extensions being installed via infostealer payloads.
## Associated Threat Actors
- **Infostealer Developers:** Groups behind RedLine, Racoon, and Vidar steal the initial session logs.
- **Access Brokers:** Groups that aggregate and sell "raw logs" on dark web marketplaces.
- **PhaaS Operators:** Operators of **Kali365** and **Octopi365**.
## Detection Methods
- **Behavioral Detection:** Monitoring for "Impossible Travel" (e.g., a session token used in New York and London within 10 minutes).
- **ITDR (Identity Threat Detection and Response):** Linking endpoint alerts (malware execution) to cloud identity logs (new session initiated from a new IP).
- **Token Monitoring:** Flagging sessions that do not match the expected device hardware or browser fingerprinting.
## Mitigation Strategies
- **Token Lifespan:** Implement short-lived session tokens and aggressive timeout policies.
- **Conditional Access:** Enforce policies that require compliant, managed devices for access to critical resources.
- **Token Revocation:** Ensure that password resets or security incidents trigger a global revocation of all active session tokens/refresh tokens.
- **Phishing Protection:** Use FIDO2-compliant hardware keys which are resistant to token-stealing phishing kits.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** Proxy-based phishing that captures tokens in real-time.
- **Infostealers:** Malware designed to exfiltrate browser-stored data.
- **OAuth Consent Phishing:** Tricking users into granting permissions to a malicious app.