Credential stuffing vs Session hijacking

Why they differ

Credential stuffing comes in through the front door with a reused password; session hijacking skips the login and takes over someone already logged in.

Credential stuffing

Fundamentals

Trying stolen user names and passwords from one leak on many other sites, hoping people used the same password there.

Formal

An automated attack in which large lists of login details, taken from an earlier data breach elsewhere, are fed into the login pages of other services. It does not guess; it relies on people reusing the same password across accounts.

In plain English

A thief finds your house key on the street and then tries it on your car, your office and your summer house - just in case.

In practice

After a fitness app leaks its users' logins, attackers run the list against a Danish online shop; a few thousand customers find orders paid with their saved cards before the shop's IT lead blocks the flood of login attempts.

Why it matters

One leak at a small, careless site can unlock accounts at a bank or an employer, which is why a different password for each site and MFA matter so much.

Session hijacking

Fundamentals

Taking over someone's session after they have logged in, so the attacker is treated as that user without knowing the password.

Formal

An attack in which the session token or cookie that proves a user has already logged in is stolen or guessed and then reused from the attacker's own machine. Because the check happened at login, the system accepts the attacker as the real user.

In plain English

Someone copies the stamp on your hand outside the club and walks in as if they had shown ID at the door.

In practice

A harmful browser extension on a case worker's PC in a Danish region copies her live session cookie for the cloud mail service; the attacker opens her inbox from abroad without ever meeting an MFA prompt.

Why it matters

It gets around strong passwords and even MFA, because it steals what the system hands out after those checks have passed.

Shared connections

Threat