Session Hijacking
0 confirmed incidents.
VERIS: hacking:Session fixationMITRE ATT&CK: T1185 (Browser Session Hijacking)T1040 (Network Sniffing)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Session hijacking covers an attack that takes over an already-authenticated session, a logged-in browser tab or an active network connection, rather than obtaining a username and password directly. It maps to two MITRE ATT&CK techniques: T1185 (Browser Session Hijacking), abusing an active, authenticated browser session to act as the victim, and T1040 (Network Sniffing), capturing session tokens or other credential material as it passes over the network. Because the attacker inherits an already-logged-in session, this technique can bypass password and even multi-factor-authentication controls that would otherwise have stopped a credential-theft attempt.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Session Hijacking on Breach Census?
0 confirmed incidents are currently classified as Session Hijacking.
Which MITRE ATT&CK techniques does the Session Hijacking classification cover?
This classification maps to MITRE ATT&CK techniques T1185 (Browser Session Hijacking), T1040 (Network Sniffing).
What counts as a confirmed incident for the Session Hijacking classification?
An incident counts here once it carries the Session Hijacking attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.