NatJack: New Attack Hijacks TCP Sessions by Abusing Network Address Translation

Key points

• Security researcher Malcolm Stagg unveiled a new attack class called NatJack at Black Hat USA 2026.
• NatJack abuses network address translation, the everyday process that lets many devices share one public internet address, to hijack active TCP sessions.
• The techniques also spoof DNS responses, reveal a victim's real IP address and port, and can knock a router's NAT table offline.
• Stagg demonstrated the attacks across network infrastructure devices, meaning routers and firewalls of the kind used in homes, offices and data centres.
• No single patch fixes the class of flaw; it lives in how NAT itself keeps track of connections.

A security researcher has found a way to hijack live internet connections by tricking the piece of plumbing almost every network relies on. Malcolm Stagg calls the attack NatJack, and he presented it at Black Hat USA 2026. We first covered NatJack on 7 August 2026, when Stagg's initial findings showed routers from Microsoft to Linux mishandling connection tracking.

The target is network address translation, or NAT: the quiet trick your home router performs every second, letting your phone, laptop and games console all share a single public address on the internet, keeping a table of who asked for what so replies come back to the right device.

Stagg's work, first written up by The Hacker News, shows that this table can be manipulated from the outside in ways its designers never anticipated.

What can an attacker actually do with NatJack?

Stagg demonstrated four separate abuses of the same underlying weakness.

The first is TCP session hijacking. TCP is the protocol that carries most of the web and app traffic you use. Hijacking a session means an attacker can slip into a conversation already happening between your device and a remote server and start sending data as if they were you or the server.

The second is DNS spoofing. DNS is the internet's address book, turning names like yourbank.com into the numbers computers actually use. A spoofed DNS reply can quietly redirect a victim to a fake site that looks identical to the real one.

The third trick unmasks the victim. NatJack can reveal the real public IP address and exact port a person's device is using, information normally hidden behind the router and useful for follow-on attacks.

The fourth is exhaustion. Flooding the NAT table with junk entries fills it until no new connections work, effectively knocking a network offline.

How does the attack work in plain terms?

Every router keeps a record of which internal device is talking to which outside server. NatJack sends carefully shaped packets from the internet that fool the router into changing those records, adding false ones, or filling the notebook until there's no room left.

Because the weakness sits inside NAT itself, defined across internet standards going back decades, it isn't a bug in one product that a single vendor can quickly fix. Stagg tested the techniques across multiple network infrastructure devices, the routers, firewalls and gateways that sit between users and the wider internet.

Would multi-factor authentication have helped?

Honestly, no. This is a network-layer attack, not a login attack. MFA protects the moment you prove who you are to a website or app. NatJack meddles with the pipes underneath, after you're already connected. That's worth saying plainly, because MFA gets recommended for almost everything, and here it simply isn't the right tool.

What should ordinary users watch for?

For now, there's not much to do at the kitchen table. Keep your home router firmware current, and pay attention to browser certificate warnings, since a valid HTTPS certificate is still the clearest sign that the site you reached is genuine, even if DNS was tampered with along the way.

Enterprise network teams should review NAT timeout settings, table size limits, and any stateful firewall rules that assume outside traffic can't influence internal connection state. It turns out it can.

Vendor advisories from router and firewall makers are the next thing to watch. The attack class won't be patched in a single update cycle; expect a slow, uneven response across hardware generations.