MITRE ATT&CK Technique
T1539Steal Web Session Cookie
- First Reported
- Jan 22, 2020
- Latest Reported
- Nov 6, 2026
Official Description
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)
There are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on [User Execution](https://attack.mitre.org/techniques/T1204) by tricking victims into running malicious JavaScript in their browser.(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023)
There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)
After an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application.
Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)
There are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on [User Execution](https://attack.mitre.org/techniques/T1204) by tricking victims into running malicious JavaScript in their browser.(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023)
There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)
After an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application.
- Tactics
- Credential Access
- Platforms
- Linux, macOS, Office Suite, SaaS, Windows
- MITRE Version
- 1.5
- Last Modified
- May 12, 2026
Reported Context (251)
- The malware copies browser profiles containing cookies and is designed to collect and upload browser cookies. Analysis Finds Signed “Abe Office” RAT Built to Steal Browser Data via Hidden Browsers
- An iOS chain stole cookies outside Safari, and the Android payload targeted cookies stored in Chrome. Sekoia Reports Midnight Blizzard Campaign Using Watering Holes to Target iOS and Android
- In a fake AI campaign, hidden processes reportedly stole browser session cookies. Five Active Cyber Threats Targeting US Enterprises in October 2026
- The JavaScript payload was designed to steal browser cookies. CISA Adds Patched Apple Flaw CVE-2024-27834 to KEV After Exploitation Reports
- The phishing services capture victims' authentication session cookies. Fake AI Event Invitations Use Phishing Kits to Target Microsoft and Google Accounts
CVE (77)
Malware (336)
People (136)
Threat Actors (255)
MITRE ATT&CK (310)
Vendors (170)
Products (758)
Tools (294)
Industries (130)
Countries (75)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.