Skip to content

Browser Session Hijacking

Technique · ATTACK:enterprise:T1185

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1185",
  "title": "Browser Session Hijacking",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1185",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--544b0346-29ad-41e1-a808-501bb4193f47",
  "external_id": "T1185",
  "domain": "enterprise",
  "created": "2018-01-16T16:13:52.465Z",
  "modified": "2026-05-12T15:12:00.633Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "ICEBRG Chrome Extensions",
      "url": "https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses"
    },
    {
      "source_name": "Cobalt Strike Browser Pivot",
      "url": "https://www.cobaltstrike.com/help-browser-pivoting"
    },
    {
      "source_name": "cobaltstrike manual",
      "url": "https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"
    },
    {
      "source_name": "Wikipedia Man in the Browser",
      "url": "https://en.wikipedia.org/wiki/Man-in-the-browser"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20cf444d-b538-4971-b054-3d749aa945f0

Fidelis TrickBot Oct 2016 · IBM TrickBot Nov 2016 · Microsoft Totbrick Oct 2017 · Trend Micro Trickbot Nov 2018

ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f3fffec-6c91-45e2-8c4c-d1c7bdcde76b

Dell Dridex Oct 2015

ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c7a0e49-6b38-417a-881b-6f9474ea4ec2

Prevx Carberp March 2011 · Trusteer Carberp October 2010

ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54a3ec14-70cd-4c2f-b482-b10d44a1a713

Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:S0530 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--577796a0-efbb-4023-9083-a76f97bec6f8

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bbbd951-0c4a-4293-b0a8-27751b953882

Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7641ab63-39e1-4cd2-8e9c-9bd1ce6da370

Breakdev Evilginx 2.2 NOV 2018

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ac62413-be9a-40ef-996d-017c04f04d5b

Securelist Brazilian Banking Malware July 2020 · IBM Grandoreiro April 2020 · ESET Grandoreiro April 2020

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d6d88c3-dbfe-492a-8c4c-ee4bfc10bdc3

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9275c60f-61ee-46f5-a37b-99b2713d1522

Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a251b2a7-b46d-415a-859f-a3b510dcc66e

Google XLoader 2017

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a64c16bf-284e-4a74-a5c9-bcaee4d36313

Cyberint Qakbot May 2021 · Kaspersky QakBot September 2021

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9f79f14-d160-4be5-8bbe-ad0b52770b9f

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad7f635b-7775-4706-8577-eee00612c996

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5e3e18d-124e-4ae2-a95c-9db8f6d53000

IBM IcedID November 2017 · Juniper IcedID June 2020

ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf130e28-dbd6-4312-ba0a-a3cbcf05c064

Cybereason Chaes Nov 2020

ATTACK:enterprise:S9044 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbfe9e7c-c94b-4bc3-b2e1-3513754f13b7

Artic Wolf Labs Kali365 Device Code April 2026

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eafddae6-8e14-491b-82af-40ddaccb99c6

TrendMicro BKDR_URSNIF.SM

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.