NatJack: New Attack Hijacks TCP Sessions by Abusing Network Address Translation

Key points

• Security researcher Malcolm Stagg unveiled a new attack class called NatJack at Black Hat USA 2026.
• NatJack abuses network address translation, the everyday process that lets many devices share one public internet address, to hijack active TCP sessions.
• The techniques also spoof DNS responses, reveal a victim's real IP address and port, and can knock a router's NAT table offline.
• Stagg demonstrated the attacks across network infrastructure devices, meaning routers and firewalls of the kind used in homes, offices and data centres.
• No single patch fixes the class of flaw; it lives in how NAT itself keeps track of connections.

A security researcher has found a way to hijack live internet connections by tricking the piece of plumbing almost every network relies on. His name is Malcolm Stagg. He calls the attack NatJack, and he presented it at Black Hat USA 2026.

The target is something called network address translation, or NAT. That is the quiet trick your home router performs every second: it lets your phone, laptop, TV and games console all share a single public address on the internet, keeping a little table of who asked for what so replies come back to the right device.

Stagg's work, first written up by The Hacker News, shows that this little table can be poked and prodded from the outside in ways its designers never planned for.

What can an attacker actually do with NatJack?

Quite a lot, and none of it good. Stagg demonstrated four separate abuses of the same underlying weakness in how routers track connections.

The first is TCP session hijacking. TCP is the protocol that carries most of the web, email and app traffic you use. Hijacking a session means an attacker can slip into a conversation that is already happening between your device and, say, your bank, and start sending data as if they were you or the bank.

The second is DNS spoofing. DNS is the internet's address book, turning names like yourbank.com into the numbers computers actually use. A spoofed DNS reply can quietly send a victim to a fake site that looks identical to the real one.

The third trick unmasks the victim. NatJack can reveal the real public IP address and the exact port a person's device is using, information that is normally hidden behind the router and useful for follow-on attacks.

The fourth is exhaustion. By flooding the NAT table with junk entries, an attacker can fill it up so no new connections work, effectively knocking a network offline.

How does the attack work in plain terms?

Every router keeps a mental note of which internal device is talking to which outside server. NatJack sends carefully shaped packets from the internet that fool the router into either changing those notes, adding fake ones, or filling the notebook until there is no room left.

Because the weakness sits inside NAT itself, which is defined across a stack of internet standards going back decades, it is not a bug in one product that a single vendor can quickly fix. Stagg said he tested the techniques across multiple network infrastructure devices, meaning the routers, firewalls and gateways that sit between users and the wider internet.

Would multi-factor authentication have helped?

Honestly, no. This is a network-layer attack, not a login attack. MFA protects the moment you prove who you are to a website or app. NatJack meddles with the pipes underneath, after you are already connected. That is worth saying plainly, because MFA gets recommended for almost everything, and here it simply is not the right tool.

What should ordinary users watch for?

For now, not much you can do at the kitchen table. Keep your home router firmware up to date, and pay attention to browser warnings about certificates, since a valid HTTPS certificate is still the best sign that the site you reached is the real one, even if DNS was tampered with along the way.

Expect vendor advisories from router and firewall makers in the coming weeks. Enterprise network teams will want to review NAT timeout settings, table sizes, and any stateful firewall rules that assume the outside world cannot influence internal connection state. It turns out it can.