Cyber Security News

New BitM Attack Enables Hackers to Hijack User Sessions in Seconds

A recent threat intelligence report highlights the emergence of a sophisticated cyberattack technique known as Browser-in-the-Middle (BitM), which allows hackers to hijack user sessions across various web applications in a matter of seconds.

This method exploits the inherent functionalities of web browsers to deceive victims into believing they are interacting with a secure connection, while in reality, their actions are being performed on the attacker’s machine.

BitM AttackBitM Attack
Monitoring the victim container

Exploiting Session Tokens

BitM attacks target session tokens, which are stored in a user’s browser after completing multi-factor authentication (MFA).

These tokens are crucial for maintaining an authenticated state, making them a prime target for adversaries.

Traditional methods, such as using transparent proxies like Evilginx2, require significant customization and can be time-consuming.

In contrast, BitM offers rapid targeting capabilities with minimal configuration, allowing hackers to reach any website quickly.

Defense Strategies

To counter these threats, organizations are advised to implement robust defenses.

Mandiant suggests using client certificates and hardware-based MFA solutions like FIDO2-compatible security keys.

FIDO2 authentication flow

These measures can effectively deter BitM attacks by requiring authentication elements that are difficult for attackers to manipulate.

For instance, FIDO2 keys ensure that authentication responses are tied to the request’s origin, preventing attackers from replaying them on different sites.

However, these protections are only effective if the device hosting the security keys or certificates remains uncompromised, emphasizing the need for a layered security approach.

The development of internal tools like Delusion by Mandiant demonstrates the potential scale of BitM attacks.

Delusion allows operators to target applications without prior knowledge of their authentication protocols, making session-stealing attacks more accessible.

While Mandiant has chosen not to publish Delusion due to weaponization concerns, open-source alternatives like EvilnoVNC and Cuddlephish are available for testing defenses against such threats.

As BitM attacks continue to evolve, organizations must prioritize robust authentication and access-control mechanisms to protect sensitive data and networks.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

Aman Mishra

Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Recent Posts

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…

2 days ago

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code execution…

2 days ago

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…

2 days ago

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…

2 days ago

EU Targets Stark Industries in Cyberattack Sanctions Crackdown

The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…

3 days ago

Venice.ai’s Unrestricted Access Sparks Concerns Over AI-Driven Cyber Threats

Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…

3 days ago