#session-hijacking — Public Fediverse posts

Identity Theft Dominates 4 Key Threat Patterns

Malicious hackers targeted identities in nearly half of all confirmed attacks, with session hijacking and replay emerging as the most effective tactics for gaining unauthorized account access. This alarming trend highlights the growing threat of identity theft in today's digital landscape.

https://osintsights.com/identity-theft-dominates-4-key-threat-patterns?utm_source=mastodon&utm_medium=social

#IdentityTheft #SessionHijacking #MfaBypass #CredentialStuffing #EmergingThreats

Anthropic Warns of Infostealer Malware Hijacking Claude Sessions

Beware of infostealer malware that's hijacking Claude sessions! Anthropic is taking swift action to protect users, including signing them out of compromised accounts, removing saved payment methods, and offering refunds for unauthorized charges.

https://osintsights.com/anthropic-warns-of-infostealer-malware-hijacking-claude-sessions?utm_source=mastodon&utm_medium=social

#InfostealerMalware #EmergingThreats #AiSecurity #SessionHijacking #MalwareOperations

⚠️ Extensions hijack sessions instead of just stealing data At least 12 fake #TikTok downloader extensions inject scripts to capture Facebook session cookies, enabling full account takeover without credentials across Chrome and Edge installs. #ransomNews #BrowserSecurity #SessionHijacking

📬 Storm Infostealer umgeht 2FA: Malware übernimmt Accounts ohne Passwort
#DarkCommerce #Malware #2FAumgehen #AccountÜbernahme #BrowserDatenklau #Cybercrime #Datendiebstahl #Infostealer #MalwareasaService #SessionHijacking #StormInfostealer https://sc.tarnkappe.info/d93668

Microsoft Authenticator’s Unclaimed Deep Link: A Full Account Takeover Story (CVE-2026–26123)
This vulnerability is an Authentication Bypass, specifically a session hijacking issue affecting the Microsoft Authenticator app. The root cause was improper handling of deep links within the application, which allowed malicious actors to craft unclaimed deep links containing account tokens. When users clicked these links, their active sessions were hijacked, resulting in full account takeover without requiring any user interaction other than clicking a link. To exploit this, an attacker could generate a malicious deep link with an embedded account token and share it via SMS or email. The session hijack occurred due to the application's failure to verify the authenticity of deep links before processing them. This vulnerability has been assigned CVE-2026–26123. Microsoft rewarded $50,000 for this find and immediately patched the issue. To prevent similar vulnerabilities, it is crucial to thoroughly validate and sanitize all user-controlled inputs, including deep links. Key lesson: Always verify the authenticity of user-supplied data before processing it. #BugBounty #Cybersecurity #AuthenticationBypass #SessionHijacking #Infosec

https://infosecwriteups.com/microsoft-authenticators-unclaimed-deep-link-a-full-account-takeover-story-cve-2026-26123-e0409a920a02?source=rss------bug_bounty-5

Bad actors are creating browser extensions that claim to be ChatGPT productivity tools, but that steal your account credentials and hijack sessions instead.
While researchers can find and warn us about these malicious extensions, it’s important to recognize that we’re about to enter an era where this kind of behavior is actually relied on by good actors (read: agents) as well. It’s imperative that we work on developing alternatives to this.
#Security #TokenHijacking #SessionHijacking
https://www.bitdefender.com/en-us/blog/hotforsecurity/beware-fake-chatgpt-browser-extensions-are-stealing-your-login-credentials

📬 Pi-hole XSS CVE-2025-53533: kritische Sicherheitslücke entdeckt
#Cyberangriffe #ITSicherheit #AdministrationsZugriff #CookieDiebstahl #CVE202553533 #PiHole #SessionHijacking #TemplateFehler #XSSFehler https://sc.tarnkappe.info/182aaf

Google Debuts Device-Bound Session Credentials Against Session Hijacking

https://www.feistyduck.com/newsletter/issue_128_google_debuts_device_bound_session_credentials_against_session_hijacking

#HackerNews #Google #Device-Bound #Credentials #SessionHijacking #CyberSecurity #TechNews

High Severity Vulnerability Discovered in CP Plus Router: Immediate Attention Needed https://thecyberexpress.com/cp-plus-router-vulnerability/ #CPPlusRouterVulnerability #TheCyberExpressNews #SessionHijacking #Vulnerabilities #CPPlusCPXRDE21S #TheCyberExpress #FirewallDaily #CIVN20250005 #HTTPsession #CyberNews

Hackers Can Hijack Your MFA Enabled Email Accounts By Stealing Cookies https://cybersecuritynews.com/hackers-hijack-mfa-enabled/ #CybersecurityThreats #SessionHijacking #CyberSecurity #Threats #Email

As always the information in this thread as well as more can be found in my notes at: https://notes.zanidd.xyz/

Thank you for reading my thread and see you in the next one :)

#session #csrf #xss #sessionhijacking #sessionfixation

Remediating Open Redirect

• Strictly validate URLs
• Do not use user-supplied URLs
• Check supplied values (valid, not an URL, appropriate for the app)
• Sanitize input with an allowlist of trusted hosts (or regex)
• Force redirects to first go through a page notifying users that they're leaving the site

#cybersecurity #session #csrf #xss #sessionhijacking #sessionfixation

Remediating CSRF

• Check if user is authorized to perform action
• Add randomly generated + non-predictable tokens (anti-csrf-token, csrf-tokens)
• Referrer Header Checking
• Implement Two-Step operation (Operation is not executed when called, but needs a verification)
• Make Cookies SameSite!

#cybersecurity #session #csrf #xss #sessionhijacking #sessionfixation

Remediating XSS

• Validation of user input (on the server side)
  • Use positive approach (allowlist)
  • verify existence of actual Input
  • Enforce Input Size restriction
  • Check Input Type and only allow certain types
  • Check range of value and restrict it
  • Sanitize special chars
• HTML Encoding Output (especially user-controlled output)
• Do not embed user input into client-side scripts
• Have a good CSP (Content Security Policy)
• Make Cookies HTTPOnly!

#cybersecurity #session #csrf #xss #sessionhijacking #sessionfixation

Remediation Session Fixation

• Generate new session ID after authenticated operation (invalidate pre-login session id and generate a new one post-login)
• use libraries and built in mechanisms for session management, don't build custom implementations

Example Function for PHP:

session_regenerate_id(bool $delete_old_session = false): bool

#cybersecurity #session #csrf #xss #sessionhijacking #sessionfixation

Remediating Session Hijacking

• Pretty challenging to counter session hijacking
• Monitoring + Anomaly Detection
• safer bet to counter than to eliminate all vulns

#hacking #cybersecurity #session #csrf #xss #sessionhijacking #sessionfixation

Here is some Advice on how to remediate common Session Security Attacks/Vulns (based on HTB Academy).

1/? 🧵

#hacking #cybersecurity #session #csrf #xss #sessionhijacking #sessionfixation

I came across Headlines trying to introduce fear of #FIDO2.

"Using MITM to bypass FIDO2 phishing-resistant protection" and "Passwordless Authentication Standard FIDO2 Flaw Let Attackers Launch MITM Attacks" seem very frightening. So I took a closer look into those articles.

https://www.silverfort.com/blog/using-mitm-to-bypass-fido2/
https://gbhackers.com/fid02-mitm-vulnerability/

They seem very much identical down to the fact they use the same illustrations. My understanding is that the demonstrated "#MITM #Attack" is actually an attack on the session coockie. So The idea is to let the #FIDO2 #Authentication take place uninterrupted and when successful, intercept the Session cockie when sent from the Relaying Party/Webserver to the client.

Maybe someone with a better understanding of the Standards can correct me but this attack looks to me as if it only attackls the session information which would be possible no mather what authentication would be used. In my understanding, secure session handling is a real thread but outside of the actual FIDO2 scope.

What do you think? Is it FIDO2 related? Or just a generic Session Session hijacking that happens to work besides others also with FIDO2 authentications?

#FIDO2 #Attack #MITM #Flaw #sessionhijacking

XSS Vulnerability in Google Subdomain Let Hackers Hijack User Sessions

Date: March 15, 2024

CVE: Not specified

Sources: Cyber Security News

Issue Summary

A significant XSS vulnerability was found in the aihub.cloud.google.com subdomain by Henry N. Caga, enabling potential session hijacking, phishing, malware distribution, and data theft. Initially hard to replicate, persistence and a double-encoded payload exposed the flaw affecting URLs with a q parameter.

Technical Key findings

The flaw was discovered after testing various payloads on the q parameter, with double encoding revealing the vulnerability across all URLs under the affected domain.

Vulnerable products

• aihub.cloud.google.com domain

Impact assessment

Risks included session hijacking, phishing attacks, malware distribution, and sensitive data theft, potentially damaging Google's reputation.

Patches or workaround

Google addressed the vulnerability, rewarding Caga $4,133.70, including a $1,000 bonus for his detailed report and proof of concept.

Tags

#XSS #Google #CyberSecurity #SessionHijacking #Phishing #Malware

FlowFixation: AWS Apache Airflow Service Takeover Vulnerability

Date: March 21, 2024
CVE: Not specified
Sources: Tenable Blog

Issue Summary

Tenable Research discovered a vulnerability, named FlowFixation, in AWS Managed Workflows for Apache Airflow (MWAA) that could allow session hijacking leading to a full takeover of the victim's web management panel.

Technical Key findings

FlowFixation combines session fixation and XSS via Amazon AWS domain misconfiguration, enabling attackers to authenticate known sessions and gain control over victim's Apache Airflow management panels.

Vulnerable products

• AWS Managed Workflows for Apache Airflow (MWAA)

Impact assessment

Potential for remote code execution on underlying instances and lateral movement to other services.

Patches or workaround

AWS has addressed the vulnerability. Users should ensure they are using updated services.

Tags

#AWS #ApacheAirflow #CloudSecurity #SessionHijacking #Vulnerability

@11110110101 @heiseonline
Wenn ich das Original (https://www.cloudsek.com/blog/compromising-google-accounts-malwares-exploiting-undocumented-oauth2-functionality-for-session-hijacking) richtig lese, besteht das Problem nur für schon geknackt Accounts. Vermutlich hilft MFA, damit es gar nicht so weit kommt?

Sonst:
"If you suspect your account may have been compromised, or as a general precaution, sign out of all browser profiles to invalidate the current session tokens. Following this, reset your password and sign back in to generate new tokens."

#Google #MFA #OAuth #SessionHijacking #SessionCookies

We need browser profile primary password logins to help prevent session hijacking

Seeing what happened this week to the Linus Tech Tips YouTube channel made me realise how well we have secured in transit data, password managers, etc (LastPass was also hacked via an end user session) but we appear to have the session data left wide open on ...continues

See https://gadgeteer.co.za/we-need-browser-profile-primary-password-logins-to-help-prevent-session-hijacking/

#browsers #security #sessionhijacking #technology

We need browser profile primary password logins to help prevent session hijacking

https://gadgeteer.co.za/wp-content/uploads/2023/03/Screenshot_20230324_140123-400x323.jpg Seeing what happened this week to the Linus Tech Tips YouTube channel made me realise how well we have secured in transit data, password managers, etc (LastPass was also hacked via an end user session) […]

https://gadgeteer.co.za/we-need-browser-profile-primary-password-logins-to-help-prevent-session-hijacking/

https://squeet.me/display/962c3e10-80792827-8fec9710a8f6040c

#LinusTechTips #TechQuickie #TechLinked #YouTube #Hacked #SessionHijacking
https://twitter.com/LinusTech/status/1639181811522867202?t=Jmz2qOYwBFnRaDVd3Ar8yg&s=09