CyberGlossary

Attacks & Threats

Cookie Hijacking

Also known as: Cookie theft, Cookie sidejacking

Definition

Theft and reuse of a user's HTTP cookies — typically session or authentication cookies — to impersonate that user against a web application.

Cookie hijacking (or cookie theft / cookie sidejacking) is a specific form of session hijacking where the attacker focuses on capturing the browser cookies that identify a user. Common acquisition paths include XSS, malicious browser extensions, info-stealer malware harvesting browser profiles, unencrypted Wi-Fi sniffing, and cross-site leaks. With a valid cookie the attacker can resume the victim's session, bypassing both password and MFA in many architectures. Mitigations include HTTPS with HSTS, the Secure, HttpOnly, and SameSite cookie attributes, short-lived tokens, device or token binding, CSP and DOM-XSS hardening to block stealing scripts, and behavioural detection of sessions reused from new devices, geographies, or IP reputations.

Examples

  • An info-stealer malware exports Chrome's cookies database; criminals replay the cookies into their own browser to access SaaS apps as the victim.
  • An attacker on an open Wi-Fi network captures an unencrypted authentication cookie and uses it to log into a webmail account.

Related terms