What is Session Hijacking?

Session hijacking (often called cookie hijacking) is stealing or reusing a valid session token so an attacker can use a web app as the victim without knowing the password. HTTP is stateless; after login, the server trusts a cookie or token on each request. Whoever holds that token looks authenticated.

What is a session, in plain terms?

After you sign in, the site issues a session identifier, usually stored in a cookie. Your browser sends it on every request. The server maps that ID to your logged-in state. Hijacking means the attacker obtains that same identifier and presents it from their own browser or script.

How do attackers steal sessions?

• Network capture on weak transport: If any part of the journey uses unencrypted HTTP or mixed content, tokens can be read on local networks. HTTPS end to end is the baseline fix.
• Cross-site scripting (XSS): Malicious script running in the victim’s browser can read cookies or tokens the page can access and send them to the attacker.
• Session fixation: The victim logs in while already holding a session ID the attacker chose. If the server does not rotate the session ID at login, the attacker keeps access.
• Malware (man-in-the-browser): Trojans can read cookies from the browser or alter transactions after the user authenticates.

Defenses include HttpOnly and Secure cookies, strict HTTPS and HSTS, XSS hardening (encoding, CSP), regenerating session IDs after login, short timeouts, and detecting token use from new IPs, devices, or suspicious behavior.

Why is this relevant to ad tech and fraud?

Advertisers and publishers rely on authenticated sessions for ad platforms, analytics, and lead tools. A hijacked session can change targeting, drain budgets, export lead lists, or approve actions the real user never performed. Separately, understanding session-level trust explains why fraud systems look beyond “logged in” to suspicious clicks, device signals, and automation. Stolen sessions also blend with automation when tokens are fed into scripts or bots, which can skew reporting and security alerts.

For teams running Google campaign networks or similar, treat platform session security like financial access: MFA, least privilege, and monitoring for abnormal changes to campaigns and billing.