Browser Session Hijacking appears across Initial Access and Positioning tactics in the MITRE F3 Framework. It describes two distinct attack patterns that exploit browser software to gain or extend authenticated access.
Two patterns of browser session hijacking
Pattern 1: Process injection The attacker injects code into a browser process, inheriting its cookies, HTTP sessions, and SSL client certificates. With the right process permissions (SeDebugPrivilege or administrator rights), the attacker can browse any intranet resource (SharePoint, webmail, internal portals) that the hijacked browser can access.
Pattern 2: Proxy pivoting The attacker sets up a proxy that routes their own browser's traffic through the victim's browser. The server sees requests as originating from the legitimate authenticated session. This method does not modify victim traffic and requires no elevated permissions; only the ability to inject the proxy.
Both patterns can bypass two-factor authentication because the session is already authenticated. The attacker assumes the victim's security context, not just their credentials.
How does this relate to phishing and malware delivery?
Browser session hijacking typically requires an initial foothold; delivered through phishing, malicious downloads, or social engineering. Once the attacker has code execution, the browser becomes a pivot point into authenticated corporate systems.
Key takeaways
- Browser Session Hijacking appears under Initial Access and Positioning in MITRE F3.
- It allows attackers to inherit active browser sessions, bypassing re-authentication and MFA.
- Proxy pivoting is particularly stealthy: it leaves no trace in victim traffic logs.
- Elevated permissions (SeDebugPrivilege) are required for process injection but not for proxy pivoting.
- The attack requires an initial foothold: phishing or malware delivery typically enables it.
What is MITRE Fight Fraud Framework™ (F3)?
The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope.
