Multi-factor authentication (MFA) and password-less authentication are highly effective in reducing the damage an adversary can cause with a stolen password. However, MFA can be bypassed if a session cookie is exfiltrated (copied or stolen) from the browser of a legitimate user who has already authenticated to an application. Session cookies store information in a user’s browser after logging into a web application, keeping the user signed in without needing to re-authenticate until the session expires or they log out. Since session cookies act as bearer tokens, anyone possessing the cookie can use it, making their exfiltration a significant security risk. Bearer tokens are susceptible to Adversary-in-the-Middle (AitM) attacks, also known as Man-in-the-Middle attacks. Additionally, there has been a rise in malware designed to extract session cookies from infected browsers, as well as phishing techniques aimed at bypassing authenticators that rely on shared secrets (such as time-based OTP).

To detect and mitigate the risk of session cookie exfiltration, a defense-in-depth strategy is recommended, along with regular (re)authentication of logged-in users. Listed below are several approaches to prevent or minimize the impact of session cookie exfiltration. Since no single method is sufficient on its own, implementing a combination of these approaches is essential for effective protection.