Session Replay Fraud
Persistent access without credentials.
Threat Intelligence
Session Hijacking & Token Replay
Severity: criticalSession ManagementAuthentication State
Affected: Mobile Banking · Open Banking
Threat IntelligenceSession / Token
Attackers steal session tokens or refresh tokens to impersonate authenticated users — bypassing login entirely through MITM, malware or insecure local storage.
MITM + Malware
Common Vector
AUTH + STORAGE
MASVS
P0
Fix Priority
Attack chain
Typical exploitation path in mobile banking
1Intercept token
2Replay session
3Fraud
Kill Chain
How this attack happens
End-to-end attack timeline observed in mobile banking incidents.
Step 1
Token intercept
MITM or malware extracts bearer token.
Step 2
Session replay
Token used from attacker environment.
Step 3
Unauthorized actions
Transfers and data access without login.
Business Impact
Impact on financial institutions
Operational, financial and regulatory consequences for BFSI.
Estimated severity
critical
SOC Intelligence
Observed risk signals
Typical APK assessment findings mapped to this threat.
critical
Tokens in SharedPreferences
Plaintext session storage.
high
No idle timeout
Sessions never expire.
Detection
How MobAIsec detects this threat
Four-phase governance pipeline — deterministic evidence only.
Phase 1
Static Analysis
- ›Hardware-backed key usage
- ›Device ID generation review
- ›Secure token storage
Phase 2
Runtime Intelligence
- ›Enrollment flow analysis
- ›Token binding signals
Phase 3
Governance Mapping
- ›PSD2 possession factor
- ›MASVS-AUTH-3
- ›CBUAE
Phase 4
Evidence Collection
- ›Keystore / Keychain usage proof
Static Analysis→Runtime Intelligence→Governance Mapping→Evidence Collection
Mitigation
Recommended banking controls
Layered defenses with coverage, effort and effectiveness ratings.
Secure Token Storage
Coverage: Very HighProtects: Local token theft
Effort
Medium
Effectiveness
90%
Android Keystore / iOS Keychain only.
Short Idle Timeout
Coverage: HighProtects: Abandoned session abuse
Effort
Low
Effectiveness
80%
5–15 min idle for banking.
Device-bound Sessions
Coverage: Very HighProtects: Cross-device replay
Effort
High
Effectiveness
92%
Bind refresh token to device key.
Regulatory Intel
Banking regulations requiring this protection
Compliance confidence and mapped control counts per jurisdiction.
UAE
CBUAE
Compliance confidence94%
12 mapped controls
View mandate →India
RBI
Compliance confidence88%
9 mapped controls
View mandate →Singapore
MAS
Compliance confidence96%
11 mapped controls
View mandate →EU
EBA / PSD2
Compliance confidence91%
10 mapped controls
View mandate →United States
FFIEC
Compliance confidence85%
8 mapped controls
View mandate →Framework Alignment
Security framework alignment
How this threat maps across MASVS, OWASP Mobile, PCI DSS, PSD2, NIST and DORA.
| Control | MASVS | OWASP Mobile | PCI DSS | PSD2 | NIST | DORA |
|---|---|---|---|---|---|---|
| Device binding | ◐ | ◐ | ○ | ● | ● | ◐ |
| Secure token storage | ● | ● | ● | ● | ● | ● |
Executive Summary
Executive risk summary
Board-ready risk dimensions and impact heatmap.
Lower = higher residual risk
Likelihood82%
Impact90%
Exploitability80%
Compliance Risk85%
Impact heatmap
Session abuse
L: 85%
I: 92%
Vendor Intel
Enterprise protection vendors
RASP, attestation and device-trust solutions for banking programs.
Approov
Runtime app attestation
Enterprise
Banking: excellent
Pros
- + Device + app integrity
Limitations
- − Cost
Transmit Security
CIAM + device trust
Enterprise
Banking: good
Pros
- + Banking-focused
Limitations
- − Platform lock-in risk
iovation FraudForce
Device fingerprinting
Enterprise
Banking: good
Pros
- + Mature fraud graph
Limitations
- − Privacy considerations
APK Preview
APK threat intelligence preview
Sample assessment output for Session Hijacking exposure.
Risk score
32
/ 100
2 critical findings
Observed risks
- ✗Token not in secure storage
Mapped controls
MASVS-AUTHMASVS-STORAGE
Upload APK to validate →Related Intel
Related intelligence
Related threats
Adjacent attack patterns
FAQ
Threat intelligence FAQ
SEO-optimized answers for security and governance teams.
How long should banking sessions last?
Use short idle timeouts (5–15 minutes) with re-authentication for sensitive operations. Refresh tokens must be device-bound.
Take action
Validate your banking APK against Session Hijacking
Upload your Android banking app for evidence-backed threat intelligence — no hallucinated findings.
- ✓Threat exposure score
- ✓Runtime hardening analysis
- ✓Banking compliance mapping
- ✓Fraud readiness score
- ✓Executive PDF report
- ✓Remediation guidance