Cookie theft: how fraudsters get the digital key to your accounts

Session cookies, also known as session keys, are a common target for cybercriminals as they allow them to gain unauthorized access to users' accounts. After a user logs into a website, such as a bank, they receive a session cookie that temporarily stores their data on their device, enabling easy navigation through various pages without repeatedly entering login credentials. However, open sessions extend beyond the user's activity, potentially leaving them vulnerable to cookie theft.

Marijus Briedis, chief technology officer at cyber security company NordVPN, emphasizes that cookies have become a primary target for hackers in 2022, with the company identifying 52 billion stolen cookies circulating online. Once logged into a site, the session cookie serves as a "digital key" that keeps the door open for the user.

If a hacker manages to steal this active cookie, they essentially become the user, gaining access to their account without needing the password, triggering a login alert, or bypassing multifactor authentication.

These cookies are typically stolen from users' devices due to inadvertently downloading malware. Once the malware infiltrates the device, it targets the browser's database, extracts active session cookies, and sends them back to the hacker. The user remains unaware of the breach until they discover unauthorized activity on their account.

The impact of cookie theft can vary, ranging from scams on social media and email accounts to unauthorized access to bank accounts, impersonation scams, and fraudulent online shopping orders.

To prevent cookie theft, users should remain vigilant about the software they download, particularly extensions, which often conceal infostealer malware. Red flags indicating a potential malware infection include sluggish device performance, faster battery drain, frequent crashes, and unusual browser behavior. Users should always log out of accounts manually instead of merely closing tabs and avoid using insecure public WiFi when logging into sensitive websites.

Regularly clearing cookies and employing a dedicated password manager can reduce the exposure of session cookies to potential theft. In the event of a suspected compromise, users should run an antivirus scan, log out of all devices, update passwords, and enable multifactor authentication for added security.