Session Hijacking in 2026: Why Hackers Steal Your Login, Not Your Password

Also on CyberFence: compare CyberFence to other VPNs side-by-side · the free CyberFence security tools .

For years the advice was simple: use a strong password and turn on two-step sign-in. That advice still matters, but attackers have adapted. In 2026, a growing share of account takeovers skip the password entirely. Instead, criminals steal the proof that you have already signed in, and use it to walk straight into your email, bank or trading account.

This is session hijacking, and two cases this month show how far it has come.

Two Cases From This Month

97 Microsoft 365 accounts taken over despite two-step sign-in

Security firm Huntress tracked a campaign from July 14 to September 22, 2026 that recorded 497 successful Microsoft 365 sign-ins across 79 organizations, out of more than 200,000 failed attempts. According to reporting on the research, 97 accounts were compromised. The attackers used fake sign-in pages that relayed the real Microsoft login, plus device-code phishing tricks. When victims signed in and completed their two-step check, the attacker captured the resulting session token and replayed it from their own systems.

Once inside, the attackers registered their own devices, replaced victims' two-step methods, and created hidden inbox rules to bury messages about payroll, direct deposits and banking. That is the setup for payroll diversion and invoice fraud.

About $2.7 million drained from logged-in Polymarket traders

On October 29, prediction market Polymarket briefly paused trading after a script from a third-party website monitoring service was swapped for malicious code. SecurityWeek and other outlets reported that the code looked for visitors who were already logged in and used their live sessions to sell positions and move funds to attacker addresses. Researchers estimated roughly 700 wallets and about $2.2 million to $2.7 million in losses. Polymarket said affected users would be made whole.

No password was stolen in either case. The attackers used sessions that were already trusted.

What a Session Token Is

When you sign in to a website or app, it does not ask for your password on every click. Instead, it gives your browser a session token, often stored as a cookie. That token says, "This person already proved who they are." It lasts for hours, days or sometimes weeks, so you stay signed in.

Here is the problem: anyone who copies that token can often look like you until it expires or is revoked, without knowing your password and without passing your two-step check again.

Three Ways Sessions Get Stolen

1. Adversary-in-the-middle phishing

A fake login page sits between you and the real site, passing everything through. You type your password and approve the two-step prompt on the real service, so everything looks normal. The fake page keeps a copy of the session the real site hands back. This is how the Microsoft 365 campaign worked. We covered a related kit in our EvilTokens phishing breakdown and in vishing attacks on Microsoft 365.

2. Infostealer malware

Infostealers copy saved passwords and session cookies from your browser in seconds. Microsoft found more than 394,000 Windows computers infected with one stealer, Lumma, in just a few months before a 2025 takedown. Verizon's 2025 Data Breach Investigations Report found that 46% of infostealer-infected systems holding corporate logins were unmanaged devices, most likely personal computers. See whether a VPN can stop infostealer malware.

3. Poisoned website code

The Polymarket case shows a third route: code that runs inside a trusted website and acts with the logged-in user's permissions. Users did nothing wrong except visit a site they trusted while signed in.

Why This Trend Is Growing

• Two-step sign-in works. As more people turn it on, stolen passwords alone are worth less, so criminals go after the session that comes after the check.
• Kits make it easy. Phishing-as-a-service kits now include relay features that capture sessions automatically.
• Sessions last a long time. Many apps keep you signed in for days or weeks for convenience, giving a stolen token a long useful life.
• One session can unlock a lot. A single email session can reset passwords on other accounts, approve payments or read sensitive files.

Where a VPN Helps and Where It Doesn't

CyberFence is a VPN and threat-blocking app, so it is worth being precise about what it does here.

Where it helps

• Blocking known phishing domains. Web Shield checks every domain your device looks up against lists of known phishing and malware sites. If a link leads to a reported fake login page, it can be stopped before you ever type anything. New pages may not be listed yet, so it is a layer, not a cure. Learn more in how DNS filtering works.
• Protecting sessions on untrusted networks. Most major sites use HTTPS, which already encrypts your session. On public Wi-Fi, a VPN adds a second layer and blocks attacks that try to redirect or intercept traffic on the local network. See whether a VPN protects from man-in-the-middle attacks.

Where it doesn't

• It cannot stop malware already on your device from copying your cookies.
• It cannot fix a compromised website. In the Polymarket case, the malicious code came from the site itself.
• It cannot stop you approving a real two-step prompt on a page you were tricked into using.

Warning Signs Your Session Was Hijacked

Session hijacking is quiet by design, because the attacker looks like you. These signs are worth acting on right away:

• "New sign-in" alerts from places or devices you do not recognize, even though you did not enter your password anywhere.
• New devices or sign-in methods listed in your account's security settings that you did not add. In the Microsoft 365 campaign, attackers replaced victims' two-step methods within hours in some organizations.
• Inbox rules you did not create, especially rules that move or delete messages containing words like "payroll," "invoice," "bank" or "deposit."
• Sent messages, replies or file shares you did not make.
• Unexpected orders, trades, transfers or password-reset emails on financial and shopping accounts.
• Being signed out unexpectedly, which can happen when a service detects suspicious use and cuts all sessions.

If you see any of these, sign out of all sessions from the account's security page, change your password, review sign-in methods and devices, and check your inbox rules. If it is a work account, tell your IT team immediately, because one hijacked mailbox is often used to target coworkers, clients and vendors next.

How to Protect Your Sessions

1. Use passkeys or a hardware security key where offered. These are tied to the real website's address, so a relay page cannot use them.
2. Never sign in from a link in an email or text. Type the address yourself or use the official app.
3. Watch for device-code requests. If someone asks you to enter a code at a Microsoft or Google "device login" page, stop. Real IT teams rarely ask for that out of the blue.
4. Sign out of sessions you are not using, especially on financial and trading sites, and use "sign out of all devices" after any scare.
5. After a suspected compromise, revoke sessions and change your password together. A password change alone may leave a stolen session working.
6. Check account security pages for unknown devices, new sign-in methods and inbox rules you did not create.
7. Avoid cracked software and unofficial extensions, the main sources of cookie-stealing malware. See fake VPN extensions in Chrome.
8. Keep your browser and operating system updated.

For Business Owners

The Microsoft 365 campaign hit dozens of organizations, and the attackers focused on payroll and banking emails. If you run a business, ask your IT provider whether your accounts require phishing-resistant sign-in, whether device-code sign-in is restricted, and how quickly stolen sessions can be revoked. Our guide to phishing emails that pass authentication checks covers the email side of this threat.

The Bottom Line

Session hijacking is the next step in a long arms race: as passwords and two-step sign-in improved, attackers moved to stealing the trust that comes after them. The defense is layered: phishing-resistant sign-in, fewer long-lived sessions, careful link habits, clean devices, and a network layer that blocks known bad domains and protects you on public Wi-Fi.

Want to go deeper? Read the CyberFence competitor comparison hub , our free privacy and security tools , or CyberFence plans and pricing .