Session Hijacking Statistics: Stolen Cookies, Infostealer Logs and MFA Bypass Figures

Stolen session cookies and tokens let attackers walk past MFA, yet most security teams have no numbers to show how common it is or how fast it is growing. This page gathers session hijacking figures from the organisations that hold the data: the Verizon Data Breach Investigations Report (DBIR), Microsoft's Digital Crimes Unit and threat intelligence teams, Google Cloud and Mandiant, and the infostealer data publisher SpyCloud. Every figure names its report, publisher and as-of period in the same sentence or table row. It covers infostealer logs as the supply of stolen sessions, adversary-in-the-middle (AiTM) phishing kits, MFA bypass rates and the uptake of session binding controls. How the attack works and how to stop it is covered in the Session Hijacking and Cookie Theft Guide; this page is the numbers. It is for identity, SOC and security leadership teams building a business case for device-bound sessions and faster revocation. Last reviewed: November 2026.

Key takeaways

• Token theft is the leading MFA bypass in Microsoft 365. In the Verizon 2025 DBIR's Microsoft 365 dataset (n=2,102), token theft was the most common MFA bypass technique at 31%, ahead of MFA interrupt (prompt bombing) and AiTM.
• Stolen sessions are traded at scale. SpyCloud's 2026 Identity Exposure Report counts 8.6 billion stolen cookies and session artifacts recaptured from malware infections and 13.2 million infostealer infections in 2025, an average of 50 credentials per infection.
• Infostealer logs predict ransomware. The 2025 DBIR found that 54% of 2024 ransomware victims had their domains in infostealer logs or marketplace postings, and 40% had corporate email addresses among the stolen credentials.
• Unmanaged devices leak corporate sessions. 46% of compromised systems with corporate logins in infostealer logs were not enterprise-managed (2025 DBIR), so endpoint controls on corporate devices miss almost half the exposure.
• One AiTM kit dominated phishing. Microsoft reports that by mid-2025 Tycoon 2FA accounted for about 62% of all phishing attempts it blocked, reached more than 500,000 organisations a month and is linked to about 96,000 victims since 2023.

Headline statistics

Each source measures something different: breach investigations, phishing telemetry, recaptured criminal data or incident response cases. Do not add or average them.

The supply side: infostealer logs

Infostealers copy browser cookie stores, saved passwords and tokens and sell them as logs. Google's Chrome team notes that stolen authentication cookies let attackers bypass two-factor authentication because the theft happens after login, and that the cookies keep working after the malware is removed. That is why infostealer volume is the best leading indicator for session hijacking.

The SpyCloud figures are the publisher's own recaptured data, not an independent census, and counts of artifacts include expired cookies. The Verizon figures are more useful for decisions: the 46% unmanaged figure points at personal devices used for work, which the DBIR attributes mostly to bring-your-own-device programmes or enterprise devices used outside policy. The Lumma disruption in May 2025 took down, suspended or blocked about 2,300 malicious domains, with more than 1,300 seized or transferred to Microsoft sinkholes. Response steps for exposed logs are in the Infostealer Logs and Session Token Abuse Guide.

Session theft by phishing: AiTM kits

AiTM kits proxy the real sign-in page, let the user complete MFA and capture the session cookie that results. Microsoft's March 2026 analysis of Tycoon 2FA is the most detailed public dataset on one kit:

• Reach: more than 500,000 organisations targeted each month and tens of millions of phishing messages monthly, with more than 30 million emails in a single month in mid-2025.
• Share: about 62% of all phishing attempts Microsoft blocked by mid-2025.
• Victims: an estimated 96,000 distinct victims since 2023, including more than 55,000 Microsoft customers and more than 100 Health-ISAC members.
• Price: $120 for ten days or $350 a month, sold as a service since August 2023.
• Infrastructure: campaign subdomains typically lasted 24 to 72 hours; the March 2026 disruption seized 330 domains.
• What it took: credentials, session cookies and authentication artifacts. Microsoft notes stolen cookies allowed access even after a password reset unless sessions and tokens were revoked.

The short subdomain lifetime is why URL blocklists alone underperform against AiTM. Kit mechanics and defences are in the AiTM Phishing Guide.

MFA bypass rates in breach data

Breach data puts session theft in proportion. The 2025 DBIR found the three MFA bypass techniques it tracks in the social engineering pattern (AiTM, password dumping and hijacking such as SIM swapping) in roughly equal measure, and together in only 4% of all breaches. Prompt bombing appeared more often but was tied to a couple of large state-sponsored campaigns. In the Microsoft 365 dataset, token theft led the bypass techniques at 31%.

Two readings follow. First, password attacks still dominate by volume, so MFA remains the first control. Second, once MFA is in place, the residual route is the session: Microsoft says phishing-resistant MFA can stop over 99% of identity compromise attempts, but a cookie stolen from an infected endpoint is used after that check. Google Cloud's report also describes session cookies taken from HAR files obtained from contractors; see the HAR Files and Session Token Leakage Guide.

Session binding: where the controls stand

Binding a session to the device that earned it is the control that makes stolen cookies worthless. Uptake figures are scarce, so the dated status below is the useful measure.

Microsoft describes Token Protection as defence in depth rather than a complete fix, and recommends starting in report-only mode with a pilot group while capturing interactive and non-interactive sign-in logs. The standard background is in the Device-Bound Session Credentials (DBSC) Guide.

Methodology notes and caveats

• Breach data undercounts session theft: the DBIR codes what investigators can prove. A replayed cookie often looks like a normal sign-in, so the initial vector may be recorded as stolen credentials or left unknown.
• Telemetry reflects the vendor's customers: Microsoft's Tycoon 2FA share is a share of phishing Microsoft blocked, not of all phishing worldwide.
• Recaptured data counts artifacts, not people: one infected device can yield hundreds of cookies, many for personal sites, and some will already have expired.
• Periods differ: the 2025 DBIR covers incidents from November 2023 to October 2024, the 2026 DBIR from October 2024 to November 2025, and Mandiant's cloud figures the second half of 2025. Always quote the period with the figure.
• Disruptions move numbers quickly: takedowns such as Lumma (May 2025) and Tycoon 2FA (March 2026) change kit and stealer shares within months, so treat any single-family share as a snapshot.

Framework mapping

What the numbers mean for defenders

1. Close the bring-your-own-device gap first: with 46% of corporate logins in stealer logs coming from unmanaged systems, require compliant or managed devices for sensitive apps, or restrict unmanaged browsers to limited sessions.
2. Monitor stealer logs for your domains: the 54% ransomware overlap makes a domain hit in a log an incident trigger, not an intelligence footnote. Revoke sessions and refresh tokens for every exposed user, not just reset passwords.
3. Move to phishing-resistant MFA: AiTM kits defeat one-time codes and push approvals; FIDO2 keys and passkeys do not hand the kit a usable session. See the Phishing-Resistant MFA Guide.
4. Pilot session binding in report-only mode: start with Token Protection or DBSC-capable apps for administrators and finance users, measure breakage, then enforce.
5. Make revocation fast: Microsoft's Tycoon 2FA analysis shows stolen cookies survive a password reset; your playbook must revoke sessions explicitly. See the Session Token Theft Response Playbook.

Metrics to track

• Stealer log hits: number of employee or contractor identities found in infostealer logs per month, and the share remediated within 24 hours.
• Time to revoke: median time from a high-risk sign-in or stealer log hit to session and refresh token revocation.
• Token replay detections: sign-ins where one session is used from a new IP address, ASN or device, triaged per week.
• Phishing-resistant coverage: percentage of privileged and finance users on FIDO2 or passkeys.
• Bound session coverage: percentage of sensitive app sign-ins enforced by Token Protection or an equivalent binding control.
• Unmanaged access: share of sign-ins to sensitive apps from unmanaged devices.

Common failure patterns

• Resetting the password and stopping: sessions and refresh tokens stolen before the reset keep working. The Snowflake breach shows how infostealer credentials on accounts without MFA open customer environments; the 2025 DBIR found about 80% of accounts used in that campaign had prior credential exposure.
• Counting only managed devices: endpoint telemetry on corporate laptops misses the 46% of exposures that come from unmanaged machines.
• Quoting artifact counts as victims: 8.6 billion cookies is not 8.6 billion compromised sessions; many are expired or personal.
• Reading the 4% as low risk: MFA bypass is a small share of all breaches because most breaches never meet MFA; in Microsoft 365 attacks token theft leads the bypass methods.
• Ignoring tokens held by integrations: the Salesloft Drift breach shows stolen OAuth tokens opening many tenants with no user session involved; SpyCloud counted 18.1 million exposed API keys and tokens in 2025.

Practitioner checklist

• Quote session statistics with publisher, report and period, and say whether they are breach, telemetry or recaptured data.
• Subscribe to infostealer log monitoring for corporate domains and treat a hit as an incident.
• Revoke sessions and refresh tokens in every credential compromise playbook.
• Require managed or compliant devices for sensitive apps, or limit unmanaged browser sessions.
• Roll out phishing-resistant MFA to administrators and finance users first.
• Pilot device-bound sessions in report-only mode before enforcing.
• Alert on token replay signals: new IP, ASN, user agent or device mid-session.
• Recheck these figures when the next DBIR, Microsoft Digital Defense Report and SpyCloud report publish.

Standards and references

• Verizon: 2025 Data Breach Investigations Report
• Verizon: 2026 Data Breach Investigations Report Executive Summary
• Microsoft: How a global coalition disrupted Tycoon 2FA
• Microsoft Security: Inside Tycoon2FA, how a leading AiTM phishing kit operated at scale
• Microsoft: Digital Defense Report 2025
• Microsoft Learn: Token Protection in Microsoft Entra Conditional Access
• Google: Fighting cookie theft using device bound sessions
• SpyCloud: 2026 Identity Exposure Report

Related NHI Mgmt Group resources: Session Hijacking and Cookie Theft Guide · Identity Attack Statistics Guide · Infostealer Threat Guide · Malware Statistics