# What is Web Session Cookie Stealing?
Source: https://arsen.co/en/resources/steal-web-session-cookie
Summary: Web Session Cookie Stealing is when fraud actors harvest active browser sessions to bypass authentication and MFA without needing a password.

## Steal Web Session Cookie

**Steal Web Session Cookie appears under Initial Access in the [MITRE F3 Framework](https://ctid.mitre.org/fraud). Sess ion cookies are authentication tokens issued after a successful login;often remaining valid for extended periods even when the browser is closed.**

## Where are session cookies found?

- Browser disk cache and local storage
- Browser process memory
- Network traffic between the client and server
- Other applications that authenticate to cloud services and store tokens in memory

## How do fraud actors steal cookies?

| Method | Description |
|---|---|
| Malware | Infostealer malware reads cookies from browser profiles on disk |
| Injected JavaScript | Malicious scripts on compromised sites extract cookies in real time |
| AiTM proxy | An [Adversary-in-the-Middle](https://arsen.co/en/resources/adversary-in-the-middle) setup captures cookies during a proxied login session |
| Phishing kit | Tools like Evilginx2 replay the victim's session to the attacker |

## Why do stolen session cookies bypass MFA?

MFA is enforced at login. Once a valid session cookie exists, the server considers the user already authenticated: no second factor is requested. An attacker who replays a stolen cookie never triggers the MFA prompt at all.

This is a critical awareness point: employees who believe MFA makes them immune to phishing are exposed to this attack path, especially via [phishing](https://arsen.co/en/resources/phishing) campaigns built on AiTM infrastructure.

## Key takeaways

- Session cookies are valid authentication tokens that persist after login, often for hours or days.
- Cookie theft bypasses MFA entirely because authentication already occurred.
- Infostealer malware, AiTM proxies, and JavaScript injection are the three primary theft methods.
- Open-source frameworks (Evilginx2, Muraena) make cookie theft accessible in commodity phishing kits.
- Short session lifetimes, secure/HttpOnly cookie flags, and device binding reduce exposure.
	

## What is MITRE Fight Fraud Framework™ (F3)?

The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope. 

[Explore the F3 Matrix](https://ctid.mitre.org/fraud)