The Enemy at Home: How Session Hijacking Attacks Bypass Two-Step Verification (2FA)

Two-step verification (2FA) and multi-factor analysis (MFA) have established themselves as the basic pillars of digital account security on the web. However, a highly sophisticated attack method that is on the rise among cybercriminals is showing that these barriers can be completely ineffective: session hijacking or Session Hijacking.

Through specialized spyware and advanced phishing techniques, attackers manage to evade the second factor in the bud without directly interacting with it.

The value of authentication cookies

When a user logs into a web application and successfully enters their password and 2FA code, the server validates their credentials and generates a unique identifier known as a session token. This token is stored in the user's browser in the form of a cookie.

From that moment on, to prevent the user from having to enter their credentials on each page they visit, the browser automatically sends this cookie in each HTTP request. This token is the "master key" of the session.

The mechanics of session hijacking

If an attacker manages to obtain a copy of that active session cookie, they can import it into their own browser. This is known as cookie theft or cookie stealing.

When the attacker makes requests to the server with the stolen cookie, the server processes it, finds it valid, and grants the attacker immediate access to the account. Since the session was already legitimately opened by the original user (who has already passed the 2FA challenge), the system does not ask for passwords or dynamic codes again.

This attack is commonly perpetrated through:

• Local Malware (Infostealers): Silent Trojans that infect the system and extract cookie databases from browsers such as Chrome, Firefox or Edge.
• Phishing in real time (Reverse Proxy): Fake pages that intercept both the credentials and cookies returned by the legitimate server in real time.
• Man-in-the-Middle (MitM) attacks: Interception of traffic on unprotected Wi-Fi networks when proper encryption is not implemented.

Mitigation and defense strategies

For software developers and system administrators, mitigating session hijacking requires implementing cryptographic best practices:

1. Secure cookies: Configure cookies with the HttpOnly flags (prevents access through JavaScript) and Secure (forces exclusive transmission under HTTPS).
2. DPoP (Demonstrating Proof-of-Possession): Cryptographically link session tokens with a public key generated by the client browser so that they do not work if copied to another machine.
3. Contextual Monitoring: Automatically invalidate sessions if sudden changes in the user's IP address, User-Agent or browser fingerprint are detected.