AitM Session Cookie Replay Post-MFA: IP Mismatch and Device Fingerprint Anomaly

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects session hijacking attempts where a session cookie is used from a different IP address or user-agent immediately following a successful MFA authentication event. This behavior is indicative of an adversary replaying a stolen session token.