Session hijacking jumped 127% year over year, and post-authentication token theft alone spiked more than 200% in the same window, according to account takeover research from DeepStrike. MFA didn't fail in any of those cases. It did exactly what it was built to do and then got walked right past.
We've spent five years telling business owners to turn on MFA, and they did. Attackers noticed too, and instead of trying to beat MFA, they just started stealing what MFA hands out once you've already used it: a session token that says "this person is legit, stop checking."
MFA proves who you are for about half a second. Session hijacking happens in the other 23 hours and 59 minutes of the day, which is one of the many evolutions attackers have made that business owners need to be aware of.
Session hijacking is when an attacker steals the token your browser holds after you log into an account, then uses that token to get in without ever needing your password or an MFA code.
Every time you log into Microsoft 365 or your CRM, the app hands your browser a token that says "this person already proved who they are, stop asking." That token gets checked every time you load a new page instead of making you log in again and again. It’s convenient for you, and just as convenient for whoever manages to steal it.
This is a different animal than credential theft, which goes after your password. Session hijacking skips the password step entirely and grabs the pass an attacker gets after someone has already logged in the right way.
MFA checks who you are once, at the moment you log in. It never checks again for the rest of that session. We get asked this constantly by clients who did everything right: rolled out MFA, trained their team, and felt good about it. But MFA was built to stop someone from logging in with a stolen password, not from stealing what gets issued after a real login. Attackers figured that out faster than most IT providers did.
The playbook is called adversary-in-the-middle, or AiTM, phishing. An employee clicks a link that looks like a normal Microsoft login. They type their password and approve the MFA push like always. Nothing feels wrong, because nothing visibly is. Behind that fake page, a proxy is quietly relaying everything to the real login and grabbing the session token the moment it's issued. Group-IB's breakdown of AiTM attacks lays out exactly how these kits sit between your employee and the real service without either side noticing.
Once that token is stolen, the attacker skips your password and your MFA challenge completely. They just load the token into their own browser and walk in wearing your employee's login. That's how 87% of successful cyberattacks in 2024 that came after a valid MFA login actually happened.
There are two main ways a token ends up in the wrong hands, and neither one takes much skill anymore.
SpyCloud's 2026 Identity Exposure Report recovered 8.6 billion stolen cookies and session artifacts from malware infections alone. It's the leading way attackers get past MFA on Microsoft 365 accounts specifically. HP Wolf Security found token theft behind 31% of documented M365 MFA-bypass incidents, more than MFA fatigue, SIM-swapping, and every other bypass method combined.
We had a prospect come to us last year after their previous IT provider missed the same warning signs twice. By the time it got noticed, the attacker had already been in their system forwarding emails for weeks.
While it never got to this point in this specific example, business email compromise can quickly turn into fake wire instructions, altered invoices, and payroll change requests that look completely normal because it came from the right inbox.
The dollar figures back this up. Token hijacking has become a favored path into business email compromise, which totaled over $2.9 billion in reported FBI losses in a single year. Small and mid-sized businesses show up disproportionately in that number for one simple reason: fewer checks tend to sit between a request like that and an actual wire transfer.
For businesses handling regulated data, it doesn't stop at the money. Exposed client information can trigger notification requirements under HIPAA or FINRA, turning one stolen token into a compliance problem on top of the financial one.
None of these trip an MFA alert, because MFA already did its job earlier. That's exactly why most businesses miss them until something's already gone wrong.
Stopping session hijacking means making a stolen token worthless, even when an attacker manages to get one. Here's what that takes:
None of this replaces MFA. It just stops MFA from being the only thing standing between your business and an attacker. This is the layered setup that should already be running quietly inside managed cybersecurity services, not something you find out is missing after a scare.
If your current IT provider can't answer whether token protection is turned on for your accounts right now, that's worth a direct conversation with them. It's the kind of thing our fractional IT department builds into every client's setup from day one, alongside the rest of what's in our credential theft guide. Reach out to TMGC and we'll tell you straight what's configured on your accounts and what isn't.
What is session hijacking?
Session hijacking is when an attacker steals the token or cookie issued to your browser after you log into an account, then uses it to get in without needing your password or an MFA approval, because both already happened.
Can session hijacking happen even with MFA enabled?
Yes. MFA verifies your identity once at login, but a hijacked session token is stolen after that verification already succeeded, so the MFA prompt never comes into play for the attacker.
How do I know if my session was hijacked?
Watch for logins from unfamiliar locations or devices, new email forwarding rules you didn't set up, unexpected password reset emails, or account activity that doesn't match what your employee remembers doing.
Does logging out stop a hijacked session?
It helps, since it revokes the active token, but most businesses don't notice until after the attacker has already sent emails, changed settings, or moved money. Prevention through token protection matters more than reacting after the fact.