Session Hijacking: Why a Strong Password Is Not Enough

Most advice about protecting a business account comes down to two things: a strong password and a code on your phone when you sign in. Both still matter. Session hijacking is the reason they are not the whole story, because some attacks skip the password entirely and steal what your browser receives after you have signed in. This article explains what that means in plain words, walks through a documented case that ended in payment fraud, and lists what actually lowers the risk for a small business.

What a session cookie is, in plain words

When you sign in to a website, it does not ask for your password on every click. Instead, it hands your browser a small file that says “this person already signed in.” That file is a session cookie.

Here is a simple way to picture it. Your password gets you through the front door. The session cookie is the visitor badge that lets you stay inside without showing your ID again. Someone who copies a valid badge may not need to go through the front door at all.

Two details are worth knowing. Not every cookie works this way; this article is only about the ones that keep you signed in. And according to MITRE, the nonprofit that maintains a widely used catalog of attack techniques, these session cookies are often valid for a long time, even when the website is not being used.

How session hijacking works

Session hijacking means taking over someone’s signed-in session by stealing that badge. One of the most common routes is a fake sign-in page that sits between your employee and the real website.

It usually unfolds in three steps:

1. The email. An employee receives a message with a link, for example a voicemail notice or a shared document, and clicks it.
2. The page in the middle. The link opens a page that looks exactly like the real sign-in screen, because it is quietly passing everything to the real site and back. The employee types their password and their phone code as usual, and the real site signs them in.
3. The copied badge. The real site sends back its session cookie, and the page in the middle keeps a copy. The attacker can now open the account as that employee, without knowing the password and without being asked for another code.

Security people call this an adversary-in-the-middle attack. Malicious software on a computer can also copy session cookies straight from the browser, which is a different route to the same result.

A documented case: from a stolen session to a fake payment

This is not a theoretical risk. In July 2022, Microsoft described a campaign that had tried to reach more than 10,000 organizations since September 2021. It is an older example, but the method is still in use and it shows clearly how the pieces fit together.

The attack started with a fake voicemail attachment that led to a sign-in page in the middle. Once the attackers held a stolen session, they went straight for the money:

1. They searched the mailbox for emails about invoices and payments.
2. They created a hidden rule so that replies from the company being targeted were moved out of sight and marked as read.
3. They replied inside real payment conversations, asking for money to go to a new account, then deleted their own replies.

In some cases, Microsoft observed the payment fraud starting as little as 5 minutes after the session was stolen. For a small business, that is the real cost: not the stolen login itself, but the invoice paid to the wrong account before anyone notices.

What your team can watch for

The page in the middle can look perfect, so the warning signs are mostly about how the employee got there. A sign-in screen that opens from an email link deserves a second look, especially when the message creates urgency, like a voicemail, an unpaid invoice or a shared file. The address at the top of the browser is the one detail the attacker cannot copy exactly. When in doubt, the safest habit is to close the page and open the service from a bookmark instead. That single habit means a session hijacking attempt that starts with an email never reaches the fake page.

Does the code on your phone still help?

Yes. Microsoft was explicit that this campaign did not exploit a flaw in the phone code itself. The attackers simply waited for the employee to complete it, then copied the session that came afterward.

So the honest picture looks like this. Strong passwords still stop a large share of account theft. The code on your phone still blocks attackers who only have a password. What neither one stops is a fake page that captures the session after both checks succeed.

That is where newer sign-in methods come in. Some methods, such as physical security keys and passkeys, are tied to the real website’s address, so a page in the middle cannot pass them along. Microsoft recommends this kind of sign-in, which your IT provider may call phishing-resistant authentication, to defend against these attacks. It raises the bar considerably, but no method guarantees protection against every way a session can be stolen.

A second protection works on the session itself. Your email can be set to accept sign-ins only from company devices or known locations, so a stolen badge used from an attacker’s computer is rejected.

What to do if an account is taken over

Changing the password is necessary, and on its own it may not be enough. A stolen session can keep working until it is cancelled.

Microsoft’s guidance for this situation is to reset the account’s password and also cancel its active sessions, which it calls revoking tokens. In practice, the response should cover four things:

1. Reset the password and sign the account out of every session, everywhere.
2. Look for new mailbox rules that move, hide or forward emails, and remove them.
3. Check the sent and deleted folders for messages the employee did not write.
4. Call any customer or supplier who may have received a fake payment request, using a phone number you already had.

The last step is the one that protects your money. A message from a real mailbox looks completely legitimate to the person receiving it.

Questions to settle before it happens

You do not need to understand the technology to prepare for it. You need clear answers to a few questions, ideally before the day you need them.

1. Which accounts, starting with email and banking, could move to a sign-in method that a fake page cannot reuse?
2. If an account were taken over tonight, who can sign it out of every session, and how quickly?
3. Would anyone notice a new mailbox rule that hides or moves emails?
4. Does every change of bank details get confirmed by phone, on a number you already had?
5. Does your team know to report any sign-in page that opened from an email link?

The takeaway

A strong password is still the foundation, and the code on your phone still matters. Session hijacking simply moves the attack to the moment after both checks succeed. The businesses that come through it well are the ones that combine a sign-in method a fake page cannot reuse, a fast way to cancel a stolen session, and a payment rule that always confirms bank changes by phone.