Cyber Security News

New BitM Attack Enables Hackers to Hijack User Sessions in Seconds

A recent threat intelligence report highlights the emergence of a sophisticated cyberattack technique known as Browser-in-the-Middle (BitM), which allows hackers to hijack user sessions across various web applications in a matter of seconds.

This method exploits the inherent functionalities of web browsers to deceive victims into believing they are interacting with a secure connection, while in reality, their actions are being performed on the attacker’s machine.

Monitoring the victim container

Exploiting Session Tokens

BitM attacks target session tokens, which are stored in a user’s browser after completing multi-factor authentication (MFA).

These tokens are crucial for maintaining an authenticated state, making them a prime target for adversaries.

Traditional methods, such as using transparent proxies like Evilginx2, require significant customization and can be time-consuming.

In contrast, BitM offers rapid targeting capabilities with minimal configuration, allowing hackers to reach any website quickly.

Defense Strategies

To counter these threats, organizations are advised to implement robust defenses.

Mandiant suggests using client certificates and hardware-based MFA solutions like FIDO2-compatible security keys.

FIDO2 authentication flow

These measures can effectively deter BitM attacks by requiring authentication elements that are difficult for attackers to manipulate.

For instance, FIDO2 keys ensure that authentication responses are tied to the request’s origin, preventing attackers from replaying them on different sites.

However, these protections are only effective if the device hosting the security keys or certificates remains uncompromised, emphasizing the need for a layered security approach.

The development of internal tools like Delusion by Mandiant demonstrates the potential scale of BitM attacks.

Delusion allows operators to target applications without prior knowledge of their authentication protocols, making session-stealing attacks more accessible.

While Mandiant has chosen not to publish Delusion due to weaponization concerns, open-source alternatives like EvilnoVNC and Cuddlephish are available for testing defenses against such threats.

As BitM attacks continue to evolve, organizations must prioritize robust authentication and access-control mechanisms to protect sensitive data and networks.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

Aman Mishra

Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Recent Posts

Fake Coinbase Migration Messages Target Users to Steal Wallet Credentials

A sophisticated phishing campaign is currently targeting cryptocurrency investors with fraudulent emails claiming to be…

3 minutes ago

Electromagnetic Side-Channel Analysis of Cryptographically Secured Devices

Electromagnetic (EM) side-channel analysis has emerged as a significant threat to cryptographically secured devices, particularly…

8 minutes ago

MirrorGuard: Adaptive Defense Mechanism Against Jailbreak Attacks for Secure Deployments

A novel defense strategy, MirrorGuard, has been proposed to enhance the security of large language…

26 minutes ago

New ClearFake Variant Uses Fake reCAPTCHA to Deploy Malicious PowerShell Code

A recent variant of the ClearFake malware framework has been identified, leveraging fake reCAPTCHA and…

29 minutes ago

Hackers Exploit Hard Disk Image Files to Deploy VenomRAT

In a recent cybersecurity threat, hackers have been using virtual hard disk image files (.vhd)…

4 hours ago

Bybit Hack: Details of Sophisticated Multi-Stage Attack Uncovered

The Bybit hack, which occurred on February 21, 2025, has been extensively analyzed by multiple…

4 hours ago