Session and access-token hijacking

Why this scenario matters

A token may be obtained through malware, AiTM phishing, XSS, logs, insecure storage, a compromised device, or a broken redirect. The valid session may then resemble legitimate user activity.

Controls include short token lifetimes and rotation, secure cookie attributes, device and session binding, Continuous Access Evaluation, re-authentication for sensitive actions, and behavioral detection.

The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.

Relevant ATT&CK tactics

• Collection
• Credential Access
• Initial Access
• Lateral Movement
• Persistence
• Privilege Escalation
• Stealth

Relevant ATT&CK techniques

• T1539 Steal Web Session Cookie
• T1528 Steal Application Access Token
• T1550 Use Alternate Authentication Material
• T1557 Adversary-in-the-Middle
• T1078 Valid Accounts

Reference frameworks

• MITRE ATT&CK T1539 Steal Web Session Cookie
• MITRE ATT&CK T1528 Steal Application Access Token