Cookie theft: how hackers steal your login session without your password

A fraudster can get into a bank account without ever knowing the password, and without triggering a single login alert. According to Guardian News and Media, this happens through a technique called cookie theft, a form of session hijacking that is already circulating at scale.

Marijus Briedis, chief technology officer at cyber security company NordVPN, says cookies have become the primary target for hackers. In the year to June, NordVPN identified 52 billion cookies in stolen data circulating online.

How the session becomes the weak point

Logging into a bank, email or shopping site creates a session cookie. It sits on the device and stores login data temporarily, so the account does not ask for a password on every page. Briedis compares it to a digital key that is already turned in the lock. As long as the session stays open, that key keeps working.

A session is meant to end when someone logs out. It often does not. Choosing to be remembered on a site, or simply closing the laptop without logging out, leaves the key turned. That gap is what fraudsters target.

The theft itself happens through malware, usually hidden inside a downloaded extension or piece of software. Once installed, Briedis says, it goes straight for the browser's database, grabs the active session cookies, and sends them to the hacker. The malware reaches into a device's stored data and takes the keys while nobody is looking.

What makes this different from a password theft

A stolen password still has to pass a login check, and often a multifactor prompt. A stolen session cookie skips both. The fraudster does not log in as the account holder; they simply continue a session that is already open. That is the mechanism this scam depends on: it is not a guess at a password, it is the theft of a session that was never properly closed.

The effects vary by account. On a bank, the fraudster can access funds or gather details for an impersonation scam. On social media or email, they can use the hijacked account to target other people. On a shopping account, they can redirect an order and charge it to saved payment details.

The tell

There is rarely a dramatic sign. A victim may only learn something is wrong when a site sends a security alert asking if they tried to change account details. Noticing that alert, rather than dismissing it, is the point at which the theft can still be caught before real damage is done.

What to do

Care about which browser extensions and software get installed matters, since that is where infostealer malware is usually hidden. Watching for unexpected slowdowns or unfamiliar activity on a laptop or phone, and logging out of sensitive accounts properly rather than leaving sessions open or relying on 'remember me', closes the gap fraudsters rely on.