Session Hijacking Threats Bypass Two-Factor Authentication

Recent reports reveal that session hijacking techniques are compromising accounts even with two-factor authentication (2FA) enabled. Attackers exploit session cookies, which are stored in browsers post-login, to gain unauthorized access without needing passwords or second factors. Tools like Evilginx facilitate this by acting as intermediaries, capturing login credentials and session cookies during the authentication process. The Global Threat Intelligence Report from Flashpoint indicates over 11.1 million machines were infected with infostealers in 2025, highlighting the scale of this threat. Operations like Operation Endgame have targeted infostealers, recovering millions of credentials. Despite security advancements, such as App-Bound Encryption for cookies, malware with elevated privileges can still bypass these protections. Users are advised to consider alternative authentication methods like passkeys and security keys to enhance security.

Key Points: • Session hijacking can bypass two-factor authentication by stealing session cookies. • Tools like Evilginx facilitate adversary-in-the-middle attacks during login processes. • Over 11.1 million machines were infected with infostealers in 2025, indicating a widespread threat.