You approved a sign-in. You used multifactor authentication. Yet someone else may still be able to reach your email. Session hijacking, sometimes called session jacking, helps explain how that can happen. For RIKR, it is a reason to protect the identity throughout the working day, not just at the login screen.
What is a session, and why would someone steal it?
After a successful login, an application typically uses session cookies or tokens to recognize you as you move between pages or request data. These are useful: you do not have to enter your password for every action. But some stolen session material can be replayed to impersonate a user while it remains valid and applicable security controls allow it.
Attackers can try to obtain that material through an adversary-in-the-middle phishing page that relays a real sign-in, or through malware on a device. The attacker may be stealing evidence of an already authenticated session rather than simply guessing your password. That distinction changes both prevention and response.
Source: Microsoft Learn: Understanding tokens in Microsoft Entra ID
This is an active threat, not a reason to abandon MFA.
In January 2026, Microsoft documented a multi-stage phishing and business email compromise campaign affecting organizations in the energy sector. It used familiar SharePoint-sharing workflows and compromised identities to make malicious messages appear credible. Microsoft also documented passkey-themed social engineering in September 2026, including lures that led people into phishing or device-code authorization flows.
These reports show why session and token abuse deserve attention. They do not establish a single growth rate for every industry, and they do not mean MFA is pointless. Keep MFA enabled. Improve its resistance to phishing, protect the device, and watch for misuse after authentication.
Source: Microsoft: January 2026 AiTM phishing and BEC campaign
Source: Microsoft: September 2026 passkey-themed social engineering
Protect the sign-in and what happens afterward.
- Use phishing-resistant authentication, such as supported FIDO2 security keys or passkeys, where practical. A message about passkeys is not proof that a request is legitimate.
- Evaluate access policies using appropriate device and identity signals. Token protection can help in supported environments, but availability and coverage depend on the platform and configuration.
- Keep endpoints and browsers maintained, limit unnecessary extensions, and use endpoint protection to reduce opportunities for session theft.
- Monitor identity activity and investigate unfamiliar sign-ins, unexpected authentication changes, and suspicious mailbox behavior.
Source: Microsoft Entra: Protect identities and secrets
Where RIKR fits.
RIKR brings identity protection into the broader cybersecurity conversation. Our managed cybersecurity offering includes Huntress identity threat detection and response and SIEM functionality, managed around the clock. We pair that identity visibility with managed endpoint detection and response, stronger email filtering, and security awareness training. Each layer addresses a different part of the path an attacker may take.
The goal is practical guidance and functional protection: help your people recognize suspicious requests, make access harder to misuse, and get concerning activity in front of a team that can investigate. No product can promise that every stolen session will be stopped. Licensing, integrations, and configuration determine what each control can actually do.
A password reset may be only the beginning.
If session theft is suspected, contact your IT or security team promptly using a known channel. They should assess containment, revoke relevant sessions or tokens, secure affected devices, and review changes to authentication methods, application permissions, and mailbox rules. Preserve useful evidence and follow the organization’s incident process.
Microsoft’s January investigation specifically warns that a password reset alone is insufficient. An attacker may have changed account settings or established another way back in. Recovery needs to address those changes as well as the original credentials.
RIKR takes charge in an incident, coordinating the response and helping the business understand what happens next. If your protection stops at “we turned on MFA,” let’s talk about your team, goals and needs.
Explore RIKR managed cybersecurity
Written by Joshua Price
Back to the blog