Multi-factor authentication, the "second step" when you sign in, usually a tap on your phone after your password, is one of the best upgrades any business can make. It's a strong front-door lock. But it isn't the only thing that decides whether someone can get into your accounts.
After you sign in, your browser keeps you logged in using something called a session. Think of it like a wristband at an event: once the door staff have checked your ticket, the wristband proves you belong inside, so nobody re-checks you at every step. If someone steals that wristband, they may not need to beat the door check at all. That's the heart of what's called session hijacking, and it's why we tell clients to treat multi-factor authentication as a strong baseline, not the finish line.
This isn't a reason to stop using it. It's a reason to put a few sensible protections around it.
Why the login step isn't the whole story
Multi-factor authentication blocks a huge amount of password theft and makes basic account break-ins much harder. The catch is that determined attackers don't always try to beat the login. They try to go around it.
Security researchers at Cloudflare have pointed out that attackers keep finding new ways to sidestep multi-factor authentication, and that real-world break-ins are rarely a single trick. They're a chain of steps. So the login can be locked down tight, and an attacker can still target what happens after you've signed in. That's where session hijacking comes in.
What a "session" is, and why attackers want it
When you sign into a web app, the site needs a way to remember you've already proved who you are, otherwise you'd be entering your password and a code on every click. That memory is the session. It's usually held in a small file in your browser called a cookie, which is why you'll sometimes hear this described as "cookie hijacking."
Attackers want that session because it's a shortcut. Security firms describe these session tokens as digital keys: steal a valid one and you can impersonate the real user and walk past the protections, including multi-factor authentication. They're not trying to defeat your login. They're reusing the part you already completed, so they reach the same apps and data as if they were sitting at your keyboard.
How it actually happens
Most people picture an account takeover as someone guessing a password or tricking you into approving a prompt. Session hijacking is different: the goal is to steal the proof that you're already logged in, then reuse it without setting off another sign-in challenge. There are three common ways in.
1. The fake login page in the middle
You think you're signing into a normal service, but you're actually on a convincing lookalike page that quietly sits between you and the real site. As you log in, the attacker passes everything through to the genuine service in real time, so it all appears to work, multi-factor prompt included. Microsoft has documented campaigns like this that captured the session right after the prompt was completed, then reused it. One such campaign tried to target more than 10,000 organizations, which shows how scalable the trick has become. Importantly, this isn't a flaw in multi-factor authentication. The attacker simply grabs the session after it succeeds.
2. Riding along in your browser session
A close cousin is more hands-on: instead of grabbing your details and disappearing, the attacker effectively takes the wheel of your browsing session. As Google's threat researchers put it, stealing the session token is the equivalent of stealing the logged-in session itself, and once they have it, they no longer need to pass the multi-factor check. They're not authenticating instead of you; they're riding along after you already did.
3. Lifting the session straight off the device
Not every session theft involves a clever fake page. Sometimes an attacker simply pulls session data off a computer that's already been compromised, for example by malware the user picked up. Those session "keys" can be extracted and reused elsewhere, which is one more reason a healthy, well-protected device is part of keeping accounts safe.
The fix: layers, not a single lock
Because the threat shifts to after the login, so does the defense. There's no single magic setting. The practical answer is a handful of controls working together:
- Make phishing harder to pull off by moving toward the strongest, hardest-to-fake sign-in methods for the accounts that matter most.
- Treat device health as part of security. A patched, protected computer is far less likely to leak its session keys. (See keeping company laptops secure.)
- Tighten session rules for sensitive apps so logins expire sooner and ask you to re-confirm before risky actions.
- Watch for suspicious access, a session showing up in an odd place or at an odd time, so a replayed login gets caught early.
When those pieces work together, multi-factor authentication stops being a comforting checkbox and becomes what it should be: a strong baseline, backed by real protection around the session itself. If you'd like a clear read on where your business stands, and which of these layers are worth adding first, that's exactly what we help businesses across the Denver area sort out, in plain English.