The Outlier Lab

Session Hijacking and Infostealers

Malware-harvested credentials and stolen session tokens let attackers act inside an already-authenticated session, bypassing login, MFA and login-time risk checks before moving value.

What it is

Most ATO controls run at login. Session hijacking skips login. Once a user authenticates, the service issues a token (often a cookie) that stands in for the login until it expires. If the attacker steals that token, they inherit the authenticated state, including any MFA the user completed. MITRE ATT&CK catalogs this as stealing a web session cookie.

Infostealers are commodity malware that harvest saved browser passwords, cookies, autofill data, crypto wallet files and system details from an infected device. They package everything into a "log." Logs are traded and resold, and they feed several ATO routes:

  • Credentials for Credential Stuffing, with the advantage of being fresh, current and tied to a specific site.
  • Session cookies for direct session replay.
  • Autofill and card data for purchase fraud.
  • Device details an attacker can use to look like the victim's device (described here only conceptually).

Real-time relay phishing (Phishing and Credential Harvesting) is a related route that also produces a stolen session, by deception rather than malware. Remote-access and on-device fraud happen on the victim's device rather than replaying a token somewhere else (see Remote Access Tool Detection).

How it works

Diagram: Device infection (lures, cracked software, fake updates), Log harvested: passwords, cookies, autofill, Logs traded and filtered by target domain, Session replay or fresh-credential login, Low-noise actions: payout change, redemption, purchase, transfer

Conceptually:

  1. Infection. Usually the user runs something: pirated software, a fake browser update, a malicious ad download, or a social-engineering "fix" prompt.
  2. Harvest. The stealer collects whatever the browser and apps hold, usually within seconds, and often removes itself.
  3. Market. Logs are aggregated and indexed by domain, so a buyer can find "all logs containing sessions for brokerage X."
  4. Use. Sessions are replayed while they're still valid. Credentials are used where sessions have expired.

Transaction footprint

A hijacked session often has no login event at all. Your first signal may be the money movement itself.

StageWhat you see in the dataDecision point
Session startExisting session token suddenly used from a different device, browser or network; no matching loginBind sessions to the device; check the fingerprint on every sensitive call
ExplorationNavigation that jumps straight to payout, payment methods or profileSession Behavior Anomalies scoring
ControlEmail or phone change, new payout method, new device enrolled within a session that was "authenticated" days agoRe-authenticate for every account change
Cash-outRedemption, stored-card purchase, transfer to a new destinationReal-Time Transaction Risk Scoring that doesn't treat "logged in" as trusted
ParallelThe victim may still be using the same account from their own device at the same timeConcurrent-session detection

Common variants

VariantWhat's differentWhere it shows up
Cookie and token replayStolen session used directlyWeb sessions with long lifetimes
Fresh-credential loginStealer-sourced password, high hit rateSites without MFA or with weak MFA
Refresh-token theftLong-lived tokens that mint new sessionsMobile apps; OAuth-based integrations
Relay-phishing sessionsSession captured by a phishing proxy, not malwareSee Phishing and Credential Harvesting
Device-code and consent abuseUser tricked into authorizing an attacker's device or appPlatforms with device sign-in flows
On-device fraudAttacker operates the victim's own device remotelyMobile banking; see Remote Access Tool Detection

Where it shows up

  • Marketplaces and gig platforms. Payout bank changes on seller or earner accounts (Payout Redirection, Online Marketplaces).
  • Rewards and retail. Redemptions and stored-card purchases in long-lived sessions (Loyalty and Rewards Redemption Fraud).
  • Brokerage and banking. Shorter sessions limit exposure, but "remember this device" tokens and long app refresh tokens extend it.
  • Crypto. Stolen wallet files and exchange sessions lead to immediate, irreversible transfers.

Impact

  • Verizon's 2025 DBIR found compromised credentials were the initial access vector in 22% of breaches, and credentials were involved in 88% of basic web-application attack breaches (as summarized by Flare).
  • An estimated 46% of compromised devices holding corporate credentials were unmanaged. Infections often happen on personal machines that also hold banking and shopping sessions.
  • Microsoft attributes about 2.4% of identity attacks to malware-based token theft (as summarized secondarily). That share is small, but each one bypasses MFA.
  • Fortinet reported more than 1.57 million login accounts for major ecommerce sites harvested from stealer logs ahead of the 2025 holiday season (vendor-reported).

Red flags

Prevention and detection at a glance

LayerControl or signalWhat it does here
PreventDevice Binding and Trusted DevicesTies sessions to device-held keys so a copied token is worthless elsewhere
PreventShort session lifetimes for sensitive scopes; re-authentication at sensitive actionsShrinks the replay window
PreventPasskeys and Phishing-Resistant AuthenticationStops relay-captured sessions; makes step-up hard to fake
DetectFingerprint continuity on every request, not just at loginDetects tokens that change device mid-session
DetectExternal Intelligence Feeds and Breached Password DetectionProactively resets credentials found in stealer logs
RespondWithdrawal and Payout Controls, Contact Change Cooling-Off PeriodsHolds the first payout after any change
RespondRevoke all sessions and tokens on suspicionRemoves access the attacker already has

Emerging variants and adversary adaptation

  • Stealers are the main credential supply chain. Logs carry current credentials, the exact URLs they belong to, and sessions, so they outperform old breach lists. Vendor reporting (IBM, as cited secondarily) found an 84% year-over-year increase in phishing emails delivering infostealers.
  • Microsoft identified "paste and run" lures, which trick users into running commands themselves, as the most common initial-access technique in its 2024–2025 notification data. That shifts infection away from exploits toward user action, which technical defenses can't fully stop.
  • Browser and platform vendors are building ways to bind sessions to device-held keys, so stolen cookies can't be replayed elsewhere. Expect attackers to respond with more on-device fraud (remote control of the real device) and with abuse of re-authentication fallbacks.
  • Token sprawl. OAuth refresh tokens, connected-app tokens and AI-agent delegations (Agentic Commerce Fraud) are new long-lived bearer credentials. Inventory them like passwords.
  • Attackers use stolen device details to make a session look continuous through fingerprint checks. Defenses should combine several independent signals (device, network, behavior, cryptographic binding) rather than rely on any one.

Real-world examples

  • Microsoft reported an April 2026 campaign capturing authentication tokens from more than 35,000 users in 26 countries, concentrated in healthcare and finance (relay-based rather than malware, but the same session-theft outcome).

Sources and further reading