Steal Web Session Cookie
Steal Web Session Cookie appears under Initial Access in the MITRE F3 Framework. Sess ion cookies are authentication tokens issued after a successful login;often remaining valid for extended periods even when the browser is closed.
Where are session cookies found?
- Browser disk cache and local storage
- Browser process memory
- Network traffic between the client and server
- Other applications that authenticate to cloud services and store tokens in memory
How do fraud actors steal cookies?
| Method | Description |
|---|---|
| Malware | Infostealer malware reads cookies from browser profiles on disk |
| Injected JavaScript | Malicious scripts on compromised sites extract cookies in real time |
| AiTM proxy | An Adversary-in-the-Middle setup captures cookies during a proxied login session |
| Phishing kit | Tools like Evilginx2 replay the victim's session to the attacker |
Why do stolen session cookies bypass MFA?
MFA is enforced at login. Once a valid session cookie exists, the server considers the user already authenticated: no second factor is requested. An attacker who replays a stolen cookie never triggers the MFA prompt at all.
This is a critical awareness point: employees who believe MFA makes them immune to phishing are exposed to this attack path, especially via phishing campaigns built on AiTM infrastructure.
Key takeaways
- Session cookies are valid authentication tokens that persist after login, often for hours or days.
- Cookie theft bypasses MFA entirely because authentication already occurred.
- Infostealer malware, AiTM proxies, and JavaScript injection are the three primary theft methods.
- Open-source frameworks (Evilginx2, Muraena) make cookie theft accessible in commodity phishing kits.
- Short session lifetimes, secure/HttpOnly cookie flags, and device binding reduce exposure.
What is MITRE Fight Fraud Framework™ (F3)?
The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope.
