Session/refresh-token reuse across disjoint networks without re-authentication (AiTM signature)

Ankit Mehta@Secvyn

•updated Aug 8, 2026•4•0•4

Detects anomalous session activity where a single authentication session ID is associated with multiple IP addresses and multiple distinct countries within a 20-minute window. This behavior is indicative of session hijacking, such as an Adversary-in-the-Middle (AiTM) attack, where a session token is stolen and reused by an attacker from a different location.