The main difference between session hijacking and session spoofing is how the attack is launched. In the case of session hijacking, the user is logged in when the attack occurs. On the other hand, a session spoofing attack occurs by starting a new session, which means a user need not be logged in to the target account.