Session hijacking is the theft and reuse of a web session token, usually stored in a browser cookie, to impersonate an authenticated user. Because many SSO and SaaS platforms keep users logged in for days or weeks, a stolen cookie can provide access even after a password change.
Infostealer malware routinely exports full cookie jars from infected browsers. Attackers replay those cookies from their own infrastructure, bypassing multi-factor authentication in cases where the session was established before MFA enrollment or where step-up prompts do not re-trigger.
Learn how infostealers industrialize SSO attacks in our corporate SSO gateway report and how session data appears in stealer logs in our ULP data analysis.