Session hijacking
Stealing the ticket a site gives you after login, so the thief is let in as you.
When you log in to a website, you do not send your password with every click. The site checks it once and hands your browser a session token, usually stored in a cookie: a long random string that means "this person already logged in". Every later request carries it, and the site lets you in. Session hijacking is stealing that token. Whoever holds it is treated as you, no password needed.
The nasty part is that it skips two-factor authentication too, because the second factor was already checked at login. That is why attackers love it. The most common route today is infostealer malware: a fake game mod, a cracked program or a booby-trapped download quietly copies the cookies saved in your browser and sends them off. Other routes are cross-site scripting bugs that let a script read the cookie, or an unencrypted connection that someone in the middle can watch.
Sites defend with several layers. Cookies marked HttpOnly cannot be read by page scripts, and Secure ones only travel over HTTPS. Sessions expire, and a sensitive action such as changing your email or sending money asks for the password again. Many services also watch for a session suddenly showing up from another country or device. For you, the useful habits are: log out on shared computers, use 'sign out of all sessions' if something looks off, and do not install software from shady sources.
Keep in mind
- After login, a session token in a cookie proves who you are on every request.
- Stealing it skips both the password and two-factor authentication.
- Infostealer malware that copies browser cookies is the most common way in today.
- 'Sign out of all sessions' kills stolen tokens; HttpOnly and Secure cookies make theft harder.
