How cybercriminals can hijack your accounts without passwords, login alerts
What's the story
Cybercriminals have devised a way to break into your online accounts, and they don't even need your password and they don't trigger a login alert. They can even bypass your multifactor authentication (MFA). The method, known as "session hijacking," involves stealing session cookies, small pieces of data that keep you logged into websites. Marijus Briedis, CTO at cybersecurity firm NordVPN, says cookies are now the primary target for hackers.
Cookie function
How do session cookies work?
When you log into a website, a unique session cookie is created and stored on your device.
This cookie allows you to navigate through different pages without having to re-enter your login credentials every time.
However, as long as the session remains active, especially if you've chosen to stay logged in or haven't closed it properly, you could be susceptible to cookie theft.
Theft method
How hackers steal session cookies
Hackers usually steal session cookies by tricking you into downloading malware.
Once installed on your device, the malware targets your browser's database, collects all active session cookies, and sends them back to the hacker.
This way, they can access your online accounts without needing your password or triggering a login alert.
Impact
What happens if a hacker steals your session cookie
The impact of session cookie theft can be severe.
If a hacker gains access to your social media or email account, they could use it to scam other people.
In case of banking accounts, they could directly access your funds or use the information for impersonation scams.
Even online shopping could be compromised as hackers can change and redirect orders using saved payment details.
Prevention tips
Tips to prevent cookie theft
To avoid falling victim to session hijacking, be cautious about the extensions and software you download.
Look out for signs of malware infection such as your device suddenly struggling with simple tasks or behaving oddly with redirects, pop-ups, or a changed homepage.
Avoid using public Wi-Fi networks for logging into sensitive accounts and make it a habit to manually log out of accounts instead of just closing the tab.
Additional measures
What to do if you've already been hacked?
Regularly clearing your cookies can limit the amount of data available for theft.
If you suspect a breach, run an antivirus scan and log out of all accounts on every device while changing passwords.
Multi-factor authentication (MFA) is also recommended as it provides an extra layer of security beyond just a password.
If you notice any suspicious payments, alert your bank to mitigate potential losses.