Session hijacking is the takeover of an already authenticated user session. Instead of cracking a password, the attacker steals or reuses the session token, cookie, or logged-in state that proves the user has already signed in. Once that session is captured, the attacker can act as the legitimate user until the session expires or is revoked.
This matters because many modern services rely on sessions for email, messaging, banking, and admin portals. In real attacks, malware, phishing pages, or browser theft tools may capture session cookies, tokens, or device data and then send messages, approve actions, or spread to other contacts from inside a trusted account. Defenders reduce the risk by using phishing-resistant MFA, short session lifetimes, device binding, reauthentication for sensitive actions, and alerts for unusual logins or impossible travel. If a session is hijacked, password resets alone may not be enough; active tokens must also be invalidated.