How stolen session cookies can let criminals bypass logins and MFA
The article explains how cookie theft allows fraudsters to take over an account by stealing an active session cookie, the small file that keeps someone logged in. A stolen cookie can let a criminal act as the account holder without entering their password or triggering a new login, and may sometimes bypass multi-factor authentication.
The theft usually follows an unnoticed malware download, which can capture cookies stored in a browser. Stolen sessions may be used to access bank, email, social media or shopping accounts, redirect orders or target contacts with scams. NordVPN identified 52 billion cookies in stolen data circulating online in the year to June; advice includes logging out properly, being careful with downloads, using a password manager and scanning devices if compromise is suspected.
In short
- Stolen session cookies can give criminals access to accounts.
- Malware is a common way cookies are taken from devices.
- Log out fully and scan devices if you suspect compromise.
Americas Business Cybersecurity Gadgets Technology World
Read the full article at the source →
Originally published by The Guardian as “Cookie theft: how fraudsters get the digital key to your accounts”.