A New Type of Attack Hijacks Online Sessions and Disguises Hackers as Legitimate Websites
Researchers have uncovered a sophisticated cyberattack technique called NatJack, which allows hackers to intercept and manipulate online sessions between users and their intended destinations. The attack method involves manipulating network address translation (NAT) tables, allowing attackers to hijack TCP sessions and spoof DNS queries, effectively disguising themselves as legitimate websites.
NatJack exploits the way many networks handle NAT, a technique used to translate private IP addresses into public ones when accessing external resources. By manipulating the NAT table, an attacker can reroute a user’s traffic to a malicious server, while simultaneously spoofing DNS queries to make it appear as though the user is communicating with the intended destination. This creates a convincing illusion of legitimacy, making it difficult for users to detect that their sessions have been hijacked.
The NatJack attack technique was demonstrated by researchers using a real-world example involving a popular online banking service. They created a scenario where a hacker manipulated the NAT table to reroute a user’s traffic to a malicious server, which then spoofed DNS queries to make it appear as though the user was communicating with the legitimate bank’s website. This allowed the hacker to intercept sensitive information and potentially steal funds from the victim’s account.
The NatJack attack has significant implications for online security, as it can be used to target a wide range of users and services. Given its ability to hijack TCP sessions and spoof DNS queries, this technique poses a serious threat to any organization or individual that relies on secure online communications. The fact that hackers can manipulate NAT tables without requiring advanced technical expertise or specialized equipment makes NatJack particularly concerning.
The discovery of NatJack highlights the need for organizations to reassess their security measures and take proactive steps to protect against these types of attacks. One key takeaway is the importance of using DNS over HTTPS (DoH) and DNS over TLS (DoT) protocols, which encrypt DNS queries and prevent spoofing attacks like those used in NatJack. Additionally, implementing robust NAT management practices and monitoring network traffic for suspicious activity can help detect and mitigate these types of attacks.
As a user, it’s essential to be aware of the potential risks associated with online sessions being hijacked by hackers. While the technical details of NatJack may seem complex, understanding the basics of how this attack works can help you take simple steps to protect yourself. By staying informed and taking proactive measures, you can reduce your risk of falling victim to a NatJack-style attack and maintain the security of your online communications.
Source: The Hacker News — 2026-08-07