Cookie theft: how fraudsters get the digital key to your accounts

You’ve had a busy morning of life admin, logging into various accounts to check balances and make payments. At the end of a productive few hours you close your laptop and move on to your next job.

What you don’t know is that fraudsters have hijacked your session with the bank and are now able to access your account. You are the victim of cookie theft, which belongs to a type of fraud known as “session hijacking”.

“Cookies have become the primary target for hackers,” says Marijus Briedis, chief technology officer at cyber security company NordVPN. In the year to June it identified 52bn cookies in stolen data circulating online.

When you log into a website, such as your bank’s, you are given a unique cookie that sits on your device and stores your data temporarily. This means you can move from page to page without repeatedly being asked for your login details. It’s called a “session cookie” – or key – and as soon as you log out, it stops being of use.

Move passwords out of your browser and into a dedicated password manager. Photograph: Maria Vonotna/Alamy

But while the session is open – and that will last beyond your activity if you choose to be remembered on a website, or if you do not properly close it – you could be vulnerable to cookie theft.

Briedis says: “Think of a session cookie as a digital key that’s already turned in the lock. When you stay logged into a site, that cookie is what keeps the door open for you. If a hacker steals that active cookie, they essentially become you.

“They don’t need your password, they don’t trigger a login alert, and they can often bypass your multifactor authentication (MFA).”

The cookies are stolen from your device. The theft is usually a result of you having inadvertently downloaded malware.

“Once that malware is on your device, it goes straight for your browser’s database, grabs all those active session cookies, and sends them back to the hacker,” says Briedis. “They’re essentially reaching into your digital pocket and grabbing your keys while you’re not looking.”

What it looks like

It looks like a regular session on the web. At some point you will have logged in and given your password, and maybe used MFA to prove it’s you.

You may not realise that you are a victim until you later find that someone has used the session cookie to hack your account.

If it’s a social media or email account you may discover it’s been used by scammers to trick other people. If it’s your bank they could access your account, or they could use details they find to perpetrate an impersonation scam.

And if you were shopping online, the fraudsters could change and redirect your order and charge it to your saved payment details.

You may be alerted by a security alert from a site, for example, a message asking if you have tried to change any details.

What to do

Be really careful about the extensions and software you download, because that’s where infostealer malware will usually be hidden.

Look out for signs that your laptop or phone has been infected with malware. Briedis says red flags include your device suddenly struggling with simple tasks, a battery that drains faster than it should, frequent crashes, or a browser that starts behaving oddly with redirects, pop-ups, or a changed homepage.

Do not use insecure public wifi for sites that require you to log in. The chance of cookies being stolen through this channel is low, but you should always be cautious.

Get into the habit of logging out of accounts. “Just closing a tab doesn’t end the session,” says Briedis. ”You need to manually log out to invalidate that cookie and make it useless to a thief.”

He suggests moving passwords out of your browser and into a dedicated password manager.

Clearing your cookies regularly will reduce what’s available to be stolen.

If you suspect you have been compromised, run an antivirus scan. Also log out of your accounts on every device and change your passwords.

Use MFA on accounts, as it does still offer more protection than a simple password.

Alert your bank if you notice any suspicious payments.