Skip to content

Hijacking Trust: Weaponizing Stolen Cookies and Tokens - BRKSEC-2132#

Cisco Live Europe 2026 (Amsterdam) digest Program Core pick Amsterdam · 9–13 February 2026

Abstract

Stefan Duernberger (Cisco)

  • Why: Session-token theft via adversary-in-the-middle proxies is now the dominant bypass of password- and MFA-based authentication. For an identity-focused PM, the defensive side here — device-bound credentials and shared signals — is the current frontier.
  • What: Real-world session hijacking techniques using tools like Evilginx and EvilnoVNC to steal authentication cookies, then the defensive stack: OAuth 2.0/OIDC mechanics, Google's Device-Bound Session Credentials (DBSC), Cisco Duo Passport, and the Shared Signals and Events framework for continuous authentication trust (from abstract only).
  • How: Offense-then-defense: demonstrate the cookie-theft flow, then show how device-bound session credentials and shared-signals eventing close it.
  • Where applicable: Broadly applicable to web authentication generally; DBSC is browser-dependent (Chromium lineage) and Duo Passport is Cisco product, but the protocol analysis is vendor-neutral.