TL;DR:

  • Session cookie theft allows attackers to take over authenticated accounts — including Microsoft 365, Google Workspace, banking, and accounting platforms — after you’ve already logged in and verified your MFA
  • Infostealers (malware installed on devices via phishing or fake downloads) harvest browser-stored cookies and ship them to attackers within minutes of infection
  • Adversary-in-the-Middle (AiTM) phishing proxies capture session cookies in real time as users authenticate — no malware required
  • Defences include device compliance policies, conditional access with continuous session re-validation, and rapid incident response processes for detected credential theft

Multi-factor authentication is widely deployed in UK small businesses now, and it has made straightforward credential phishing — steal the password, log in — significantly harder. Attackers have responded by targeting what comes after authentication: the session cookie that proves to a web application that you’ve already logged in.

If an attacker has your session cookie, they do not need your password or your MFA code. They are already authenticated. And the most common mechanisms for stealing session cookies — infostealers and adversary-in-the-middle phishing — are accessible to non-technical criminals via criminal-as-a-service platforms.

When you authenticate to a web application — logging into Microsoft 365, your bank, Xero, or a cloud service — the server issues a session token (typically stored as a browser cookie) that proves the session is authenticated. Subsequent requests include this cookie, so you do not need to re-enter your credentials on every page.

Session cookies are valuable because:

  • They persist after MFA is completed — the MFA check was already passed
  • They are scoped to the specific application and typically expire after hours to days
  • They can be used from any location and device — the server validates the cookie value, not where the request came from
  • Most applications do not detect when a session cookie is used from an unexpected IP address or device

Stealing a session cookie is equivalent to stealing an already-unlocked door key.

How Session Cookies Are Stolen

Infostealers

Infostealer malware is specifically designed to harvest credential material from infected devices — saved passwords, browser cookies, email access tokens, and cryptocurrency wallet files. Popular infostealers (RedLine, Lumma, Vidar, Raccoon) are sold via subscription on criminal forums, with subscription costs as low as £150/month.

Once installed on a device (typically via a phishing email attachment, a malicious software installer disguised as a legitimate tool, or a fake browser extension), infostealers silently export browser cookie stores to the attacker within minutes. The exported cookies are then uploaded to “logs” sold on criminal markets or used directly by the attacker.

The infection vector matters: many infostealer infections begin with employees downloading software from unofficial sources (cracked applications, game mods, fake PDF converters), or opening phishing attachments. The malware may run silently and be removed after exfiltration, leaving no obvious trace.

Adversary-in-the-Middle (AiTM) Phishing

AiTM phishing is a more targeted technique that does not require malware. The attacker operates a reverse proxy between the victim and the legitimate service:

  1. The victim receives a phishing email with a link to a convincing fake login page
  2. The fake login page is a transparent proxy to the real Microsoft 365 or Google login page
  3. The victim enters their credentials and completes MFA
  4. The proxy captures both the credentials and the session cookie issued after authentication
  5. The attacker uses the captured session cookie to access the account immediately

The victim sees a successful login (often redirected to the real service after), and the attacker has a valid authenticated session. Microsoft Entra ID (Azure AD) and Google Workspace sessions stolen this way provide access to email, SharePoint, OneDrive, or Google Drive depending on what the user was accessing.

AiTM toolkits (Evilginx2, Modlishka, Muraena) are freely available and widely documented. Criminal services provide AiTM phishing-as-a-service for attackers who cannot operate the infrastructure themselves.

Which Services Are Most at Risk

For UK small businesses, the highest-value targets are services that hold sensitive data or enable financial transactions:

Microsoft 365: Business email, SharePoint files, Teams conversations. Session theft here enables Business Email Compromise attacks launched from within your actual email account — far more convincing to suppliers and customers than a spoofed address.

Google Workspace: Gmail, Drive, Docs. Same pattern as Microsoft 365.

Online banking and accounting: Xero, QuickBooks, Sage accounts, and business banking portals all use session cookies. A stolen session may allow the attacker to view balances, download transaction history, or initiate payments depending on the account’s transfer controls.

HMRC Online Services / Government Gateway: Access to your business’s HMRC account, VAT returns, payroll records, and self-assessment.

CRM and customer data systems: Salesforce, HubSpot, and similar systems hold customer contact data that is valuable for further phishing or data sale.

Detecting a Session Hijacking Attempt

Signs that a business account may have been accessed via stolen session:

  • Sign-in logs showing access from unfamiliar locations or devices, particularly outside normal business hours
  • Email rules or forwards created without the user’s knowledge (common for maintaining persistence in compromised email accounts)
  • Password or MFA changes initiated from a session you do not recognise
  • Security alerts from Microsoft Entra ID, Google, or your banking platform about “suspicious sign-in”
  • Employees receiving unexpected MFA prompts (indicating the attacker is trying to escalate access)

Microsoft 365 and Google Workspace both provide admin sign-in activity logs. Reviewing these regularly for accounts with financial access or access to sensitive data is worthwhile.

How to Protect Your Business

1. Enable Continuous Access Evaluation (CAE) in Microsoft 365 / Entra ID

Continuous Access Evaluation checks whether a session is still valid against current policies in near real-time, rather than relying on token expiry. If a user’s account is disabled, their location changes significantly, or a risky sign-in is detected, CAE can revoke the session token immediately rather than waiting for it to expire.

In Microsoft Entra ID admin centre: Security > Conditional Access > Continuous Access Evaluation > Enable for all users.

2. Implement Conditional Access Policies Requiring Compliant Devices

Require that sessions can only be initiated from managed, policy-compliant devices. A stolen session cookie used from an attacker’s unmanaged device would fail the compliant device check and be blocked.

This requires Microsoft Intune or a similar MDM/UEM solution for device management, which has an associated cost — but for businesses where Microsoft 365 compromise would be catastrophic, the investment is justified.

3. Use Phishing-Resistant MFA

Standard TOTP MFA (Authenticator app codes) does not prevent AiTM attacks — the code is entered on the phishing proxy and relayed to the real service before it expires. Phishing-resistant MFA methods prevent this:

  • FIDO2 security keys (YubiKey, hardware tokens): The cryptographic binding to the legitimate domain means the key will not authenticate to a proxy site.
  • Windows Hello for Business / Passkeys: Device-bound credentials that cannot be phished via proxy.
  • Certificate-based authentication: Client certificates issued to compliant devices.

Deploying FIDO2 keys or passkeys for users with elevated access (financial roles, IT administrators, senior management) provides meaningful protection even if other users cannot be upgraded immediately.

4. Enable Anti-Malware and Restrict Browser Extensions

Infostealer infection is primarily an endpoint problem. Ensure all business devices run up-to-date anti-malware (Microsoft Defender, Malwarebytes, CrowdStrike Falcon Go for SMB) and that employees are not downloading software from unofficial sources.

Restrict browser extensions to a managed allowlist where possible — malicious browser extensions are a common infostealer delivery mechanism.

5. Restrict Third-Party App Access to Microsoft 365 and Google Workspace

Audit which third-party applications have OAuth access to your Microsoft 365 or Google Workspace tenant. Applications granted “read all email” or “read all files” permissions on a compromised account can be used to exfiltrate data without direct session access.

In Microsoft 365 admin centre: Azure AD > Enterprise Applications > review and revoke unnecessary app permissions.

Under UK GDPR, if a session hijacking attack results in unauthorised access to personal data — customer records, employee data, or correspondence — this is a personal data breach. Depending on the likelihood of harm to individuals, you may be obligated to report it to the ICO within 72 hours and notify affected individuals.

If business banking credentials or payment systems are accessed, notify your bank’s fraud team immediately. Under the Contingent Reimbursement Model, banks assess whether the account holder took reasonable precautions — having documented security policies and controls in place strengthens your position when seeking reimbursement for unauthorised transactions.

References