Session hijacking
In plain terms
When you log in, the site hands you a token proving it's really you, so it doesn't have to ask for your password on every page. Whoever steals that token gets in as you — no password, no verification code.
Definition
Session hijacking is a third party's reuse of the authentication token issued to a user after they log in, which grants access to the account without going through authentication again.
How it works
Authentication happens only once: after that, the browser presents a session cookie with every request, and that's what's taken as proof. This token is therefore the equivalent of an already-validated badge. It can be retrieved in three ways: by software installed on the machine that reads what the browser stores, on a network where traffic isn't encrypted, or through a malicious page that manages to leak it. The notable fact is that the theft bypasses authentication rather than confronting it: neither the password nor the second factor comes into play, since both have already been presented. This is what makes revoking sessions — not changing the password — the measure that actually ends access.
Warning signs
- An active session from a device or location you don't recognize
- Actions taken on your account without a new login prompt
- An unexpected disconnection followed by abnormal activity
- No two-factor authentication code received, even though a login did happen
- Account settings changed without any password having changed
How to verify
Open the list of sessions or connected devices in the account's settings: that's where the hijacking is visible, and nowhere else. An unknown entry appears there with its date and approximate location, even while the login history shows nothing unusual — since no new login took place.
What to do
Close your sessions on shared devices instead of just closing the tab. Avoid staying logged in indefinitely to sensitive services, and be wary of browser extensions, which can read what the browser stores.
If it already happened
Revoke all active sessions, on every device, before anything else — it's the only action that invalidates the stolen token. Then change the password, which in most services also forces reauthentication. Finally, check forwarding rules, recovery addresses, and authorized third-party apps.
Frequently asked questions
- Wasn't two-factor authentication supposed to prevent this?
- It protects the moment of login, and the token is issued after that moment. An attacker replaying a session doesn't need to log in: they present an authentication that's already been completed. That's why the fix is revocation, not an extra factor.
- Doesn't the browser's padlock protect my cookies?
- Encrypting the connection prevents reading the traffic between your device and the site, which rules out interception on a network. It doesn't protect against software installed on your machine, which reads the cookie where it's stored, after decryption.
Related attacks
Official sources
This article is part of the Credentials and accounts family. Last updated: 2026-09-02.