Stolen session cookies let fraudsters slip into accounts without a password

Fraudsters are turning to the small files that keep people signed in to websites as a way of breaking into bank, email and shopping accounts, according to a report in The Guardian. The technique, known as cookie theft, is a form of fraud called session hijacking.

How the attack works

When someone logs in to a site, the browser stores a unique session cookie on the device so the user can move between pages without entering their details again. That cookie stays valid until the user logs out. If a person ticks an option to be remembered, or simply leaves without signing out, the session can remain open long after they have finished.

A criminal who obtains an active cookie can effectively take over the session. Marijus Briedis, chief technology officer at the cyber security firm NordVPN, told the newspaper that cookies have become the main target for hackers. His company said it found 52bn cookies in stolen data circulating online in the year to June. Because the attacker reuses a session that is already authenticated, no password is needed, no login alert is triggered and multifactor authentication can often be sidestepped.

The cookies are usually taken by so-called infostealer malware that victims download without realising, often hidden in software or browser extensions. Once installed, it searches the browser's stored data and sends active cookies back to the attacker. Victims may only find out later, when an email or social media account is used to target others, a bank account is accessed, or an online order is redirected and charged to saved card details.

Steps to reduce the risk

• Be cautious about which programs and extensions are installed.
• Watch for warning signs of infection, such as a sluggish device, fast battery drain, frequent crashes, unexpected pop-ups, redirects or a changed homepage.
• Log out of accounts manually; Briedis noted that "just closing a tab doesn't end the session".
• Clear cookies regularly and consider keeping passwords in a dedicated password manager rather than the browser.
• Avoid insecure public wifi for sites that require a login, although this route is considered a lower risk.
• Keep multifactor authentication switched on, as it still offers more protection than a password alone.

Anyone who suspects a compromise is advised to run an antivirus scan, sign out of accounts on every device, change passwords and tell their bank about any suspicious payments.

What it means for internet users

For people who rely on browsers for banking, shopping and communication, the report is a reminder that strong passwords and login codes are only part of online security. Good habits around software downloads, signing out and device maintenance matter just as much, and security tools and guidance on malware protection remain worth exploring.