Full Report
See how session hijacking reshaped cyber threats. Learn how stolen tokens enable rapid breaches, bypass security, and impact enterprise protection.
Analysis Summary
# Tool/Technique: Session Hijacking (Adversary-in-the-Browser / Token Theft)
## Overview
Session hijacking is a technique where attackers steal active authentication tokens or cookies to bypass login requirements. By replaying these tokens, threat actors can impersonate a user’s authenticated state, effectively circumventing Multi-Factor Authentication (MFA) and traditional password protections to gain direct access to cloud services, email, and corporate environments.
## Technical Details
- **Type:** Technique / Attack Framework
- **Platform:** Web-based applications, Cloud Services (Microsoft 365, Slack, Google Workspace), SaaS platforms.
- **Capabilities:** Authentication bypass, MFA circumvention, persistent access without password knowledge, and lateral movement.
- **First Seen:** While historically present, there has been a significant surge in sophisticated "as-a-Service" variants (e.g., Kali365) observed between 2020–2025.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing
- T1539 - Steal Web Session Cookie
- **TA0006 - Credential Access**
- T1539 - Steal Web Session Cookie
- T1528 - Steal Application Access Token
- **TA0004 - Privilege Escalation**
- T1550.004 - Use Alternate Authentication Material: Web Session Cookie
- **TA0005 - Defense Evasion**
- T1550 - Use Alternate Authentication Material
## Functionality
### Core Capabilities
- **Token Replay:** Utilizing stolen cookies to simulate an active session on a different device.
- **MFA Bypass:** Because the token represents a "post-MFA" state, the service does not re-challenge the attacker for secondary authentication.
- **Credential Harvesting:** Extracting browser-stored credentials and session data via infostealer malware.
### Advanced Features
- **Phishing-as-a-Service (PhaaS):** Kits like Kali365/Octopi365 use device code phishing to trick users into authorizing attacker-controlled sessions.
- **Browser Fingerprint Bundling:** Attackers use specialized tools to mimic the victim's hardware and browser fingerprint, making the stolen session appear legitimate to security monitoring.
- **Persistence (ConsentFix):** Exploiting app permissions and OAuth "consent" flows to maintain access even if passwords are changed.
## Indicators of Compromise
- **File Names:** `Login Data`, `Cookies` (Targeted browser database files).
- **Network Indicators:**
- `kali365[.]com` (Defanged)
- `octopi365[.]io` (Defanged)
- Known Infostealer C2 communication patterns (e.g., RedLine, Racoon Stealer).
- **Behavioral Indicators:**
- "Impossible Travel" alerts (logins from geographically distant locations in short timeframes).
- Multiple concurrent sessions for a single user from different User-Agents.
- Unexpected OAuth application authorizations or "Consent to permissions" events.
## Associated Threat Actors
- **Infostealer Operators:** Groups deploying RedLine, Vidar, or Lumma.
- **PhaaS Providers:** Developers of Kali365 / Octopi365.
- **Ransomware Affiliates:** Using stolen logs as a primary initial access vector.
## Detection Methods
- **Behavioral Detection:** Monitoring for anomalous session activity, such as a session token suddenly appearing on a new device with a different IP/Fingerprint.
- **ITDR (Identity Threat Detection and Response):** Correlation of endpoint infostealer infections with subsequent cloud login anomalies.
- **Log Analysis:** Auditing Microsoft 365 Unified Audit Logs (UAL) for unexpected "Add service principal" or "Consent to application" operations.
## Mitigation Strategies
- **Token Hardening:** Implement short-lived session lifetimes and aggressive idle timeouts.
- **Token Binding:** Using hardware-backed methods to bind session tokens to a specific device.
- **Conditional Access:** Enforcing policies that require compliant, managed devices for access to sensitive resources.
- **Session Revocation:** Ensuring that password resets trigger a global "Revoke Sessions" command across all integrated SaaS platforms.
## Related Tools/Techniques
- **Infostealer Malware:** (RedLine, Racoon, Lumma)
- **Adversary-in-the-Middle (AiTM):** (Evilginx2, Muraena)
- **Device Code Phishing:** A specialized technique used to bypass MFA without needing the user's password.