Identity‑Focused Threat Report Shows Session Hijacking Drives Half of Confirmed Attacks (Prophet Security Q2 2026)
What Happened — Prophet Security investigated every alert in its customer environments from May‑July 2026, finding that 7 % of alerts were malicious. Identity‑related attacks accounted for roughly 50 % of those, with session hijacking and token replay outperforming password‑based attempts.
Why It Matters for Trust & Control Assurance —
- Continuous control‑assurance programs must capture and log authenticated session activity, because replayed tokens bypass traditional conditional‑access checks.
- Evidence of policy enforcement (e.g., MFA, conditional access) and rapid token revocation is essential for a defensible audit trail.
- The pattern highlights the need for an access‑control capability that can surface anomalous session behavior in real time.
Who Is Affected — Enterprises using cloud‑based SaaS productivity suites, identity providers, and managed security services across technology, finance, and professional services sectors.
Recommended Actions —
- Review token‑lifetime and refresh‑token policies; enforce short‑lived access tokens.
- Deploy continuous session‑monitoring and automated revocation workflows tied to conditional‑access policies.
- Collect and retain logs of token issuance, redemption, and anomalous sign‑in events for audit readiness. Source: BleepingComputer
Technical Notes — Attack vectors included session hijacking, token replay, MFA bypass, credential stuffing, and OAuth consent‑grant abuse. Success correlated with use of already‑authenticated sessions rather than password attempts. Source: same article