Cookie Hijack: Why MFA Alone Won’t Save You in 2026

Multi-factor authentication is one of the best security upgrades most small businesses can make. It blocks a huge amount of credential theft, and it makes basic account takeover much harder. If your business across the Northern Beaches has rolled out MFA in the last two years, you’ve made a real difference to your risk profile.

But MFA isn’t a finish line. It’s a strong front-door lock, and like any lock, it only matters if the attacker is trying to come through the front door.

In 2026, increasingly they aren’t. The growing problem is session cookie hijacking, where the attacker doesn’t try to break MFA at all. They wait until you’ve already used it, then steal the proof that you’re logged in.

The wristband analogy

When you sign into a web app, the site needs a way to remember you’ve already proved who you are. Otherwise you’d have to type your password and tap an MFA prompt on every single click. That stored proof is called a session token, and it’s usually held in a small file in your browser called a cookie.

Think of it like the wristband you get at an event. Once you’ve shown your ID at the door, the wristband proves you belong inside. You don’t get re-checked every time you walk between rooms.

Session cookie hijacking is the digital version of someone stealing your wristband at the bar. They didn’t break in. They didn’t show fake ID. They just have the wristband now, and they can walk wherever you can walk.

Kaspersky calls it “sometimes called cookie hijacking” because cookies are commonly where the session ID lives. Proofpoint describes session tokens as digital keys, warning that stealing a valid token lets an attacker impersonate the legitimate user and bypass authentication measures like MFA.

How attackers actually do it

A lot of teams picture account takeover as someone guessing a password or tricking a user into approving a bogus MFA prompt. Session cookie hijacking is a different shape. The attacker’s goal is to steal the proof that you’re already logged in, and then reuse it, often without triggering another sign-in challenge.

There are three common patterns we see across our managed clients.

Adversary-in-the-middle phishing

The most common path. You think you’re signing into a normal service, but the link in the email actually points to a lookalike page that sits between you and the real site. The attacker relays the login in real time, so everything appears to work, including the MFA prompt.

Microsoft has documented adversary-in-the-middle (AiTM) phishing campaigns where attackers use a reverse-proxy site to steal and intercept both the user’s password and the session cookie that proves the session is authenticated. As Microsoft puts it, this is “not a vulnerability in MFA”. The attacker isn’t breaking MFA. They’re capturing the session after MFA is completed, and reusing it.

One such campaign attempted to target more than 10,000 organisations since September 2021. This isn’t theoretical or rare.

Browser-in-the-middle session stealing

Similar idea, but more hands-on. Instead of stealing a token and running, the attacker effectively places themselves in control of the browsing session. Google’s threat intelligence team puts it bluntly: “Stealing this session token is the equivalent of stealing the authenticated session.” Once the token is stolen, “an adversary would no longer need to perform the MFA challenge.”

The attacker isn’t trying to authenticate instead of you. They’re riding along after you’ve authenticated.

Cookie theft from the endpoint

Not every session hijack starts with a fancy proxy. Sometimes the attacker just steals session data from the device itself, often via malware that’s quietly running on a laptop. Invicti explains that an attacker steals HTTP cookies from the browser’s storage and can use them to gain access to whatever the user was already signed into.

This is why a compromised home laptop in Brookvale or Mona Vale isn’t just a problem for that one user. The session tokens cached in that browser can give an attacker direct access to your shared cloud apps.

Why this changes the playbook

The thread running through all three attack patterns is the same: the attacker isn’t trying to defeat the login step. They’re trying to skip it entirely by reusing what happens after it.

That changes what good defence looks like. MFA stays in the toolkit, because it still blocks plenty. But the surface that matters is no longer just the login form. It’s the session itself, the device the session is running on, and the patterns of access during that session.

For our managed clients across the Northern Beaches, our team at Vaelis IT recommends a layered set of defences:

• Phishing-resistant sign-ins. Modern MFA methods like FIDO2 security keys or passkeys can’t be relayed through an attacker’s proxy in the same way that a six-digit code or a push notification can. They tie the authentication to the legitimate domain.

• Tight session controls. Shorter session lifetimes for sensitive apps. Re-authentication required for high-risk actions like changing a payment account or exporting a customer list. Sign-out enforced after a period of inactivity.

• Device health as part of identity. A session is only as safe as the device it’s running on. Treat unmanaged or unpatched devices as untrusted, regardless of who’s signed in.

• Suspicious-access detection. Unusual location, unusual time, unusual access pattern. These are the signals that someone else is now wearing your wristband.

What this means for an Australian small business

You don’t need a security operations centre to deal with this. The Australian Cyber Security Centre’s Essential Eight already covers the foundations, and most modern Microsoft 365 and Google Workspace plans include the controls described above. The work is in turning them on, configuring them sensibly, and monitoring them.

The mistake we see most often is treating MFA as a “we’re done” moment. It’s not. It’s a strong baseline that needs to be backed by protections around the session itself, the device the session is on, and the behaviour during that session.

If you’d like a practical review of how your business’s session controls and device hygiene stack up, get in touch with Vaelis IT. We’ll walk through your Microsoft 365 or Google Workspace setup, flag the gaps that matter, and give you a shortlist for closing them before an attacker exploits the wristband.