 |
| Anyone who stays signed in to a browser leaves a session cookie behind. If it is stolen, the attacker needs neither a password nor a second factor. |
Your antivirus just reported success. Malware found, removed, all clean. Two days later, your Google account is sending out spam, and the device list shows a computer that isn't yours. Two-factor authentication was switched on the whole time.
If this scenario sounds familiar—or terrifying—you're not alone. What you've just experienced isn't a failure of your password hygiene or your 2FA practices. It's something far more insidious, and it's happening to millions of people worldwide without them even realizing it.
Welcome to the world of session hijacking—the takeover of an already-running session that renders your carefully constructed security measures completely useless.
What Makes Session Hijacking So Dangerous?
The attacker needs neither your password nor your second factor. All they need is the small file your browser stores after you sign in, so that you don't have to type anything again on your next visit. That file is the session cookie.
Google describes it openly on its own Chromium blog: the theft happens after sign-in and therefore bypasses two-factor authentication. And it's hard to defuse with antivirus software, because the cookies keep working even after the malware has been removed.
This is the security gap that keeps security professionals awake at night—and it's about to get much worse before it gets better.
How the Theft Actually Works
At the start, there's almost always an infostealer—a program built specifically to collect credentials. It reaches your machine through:
- Cracked software downloads
- Tampered installers from unofficial sources
- Malicious email attachments
- Compromised websites
Once installed, it reads the files in which your browser stores its cookies. The attacker then imports the cookie into their own browser, calls up the site, and the service sees a valid, signed-in session and asks nothing more.
Your 2FA? Completely bypassed. Your password? Never touched.
The Numbers Are Staggering
How big this market is shows in the Global Threat Intelligence Report that security firm Flashpoint published on 11 March 2026. For 2025, Flashpoint counts more than 11.1 million machines infected with infostealers and 3.3 billion credentials and cloud tokens taken from them. Session cookies aren't even part of that count.
How close this comes to home was shown by Operation Endgame. On 24 June 2026, Europol reported a strike against the infostealers StealC and Amadey and against the SocGholish distribution network, with German involvement. 326 servers and 142 domains were taken down, and 27 million sets of credentials recovered. Victims were notified through Have I Been Pwned, among other channels.
Reinstall the system first, then change the passwords, then end all sessions. Turn the order around and you type the new password on the infected machine.
Why Your 2FA Isn't Protecting You
Here's the uncomfortable truth that most security advice ignores: the second factor sits in the wrong place.
An SMS code, an app prompt, and a security key all check who is signing in. The cookie is only created afterwards, as proof that this check was passed. Whoever holds the proof doesn't have to pass the check again.
Even Google's Advanced Protection Program doesn't change that. Anyone who stays signed in may not be asked for the security key again, according to Google. This is why security experts recommend signing out of critical services after each session—though few people actually do it.
For a deeper dive into securing your accounts properly, check out A password alone isn't enough—the BSI's comprehensive guide to modern authentication.
 |
| From the infostealer on the PC to the hijacked session: in none of the four steps is a password or a second factor requested. |
What Browsers Are Doing About It
Chrome's Approach: Progress with Limits
On Windows, Chrome has encrypted cookies with App-Bound Encryption since version 127 from July 2024 and ties the key to the application. Google names the limit itself: malware running with elevated privileges gets around the protection. That makes the theft more expensive—it doesn't prevent it.
The real progress is called Device Bound Session Credentials (DBSC) . The browser generates a key pair whose private half never leaves the device. On Windows, it sits in the TPM, the security chip on the mainboard. The service regularly asks whether the browser still holds that key. A cookie on somebody else's machine fails that question.
For websites, the technology has been available since Chrome 145. Google switched it on for itself on 9 April 2026 with Chrome 146 under Windows and has been rolling it out since 25 May 2026 for Workspace accounts and personal Google accounts—with nothing for users to enable.
Two limits remain:
- According to the W3C specification, DBSC doesn't prevent access while the attacker is still sitting on the device
- Every website has to take part itself, which is why the protection arrives at Google services first
Firefox: A Troubling Reality
Firefox looks worse here than many people assume. Its cookie database sits unencrypted on the disk. The entry in Mozilla's bug tracker, bug 56788, was filed 25 years ago, closed as WONTFIX in 2000, and reopened two years ago. It carries priority P3 and is assigned to nobody.
Total Cookie Protection doesn't change this—that's tracking protection, not security encryption.
What You Can Do Right Now
The order of operations is crucial. For an infection with malware, the German Federal Office for Information Security (BSI) sets out the sequence: reinstall the system first, change the passwords afterwards.
Anyone who does it the other way round and types the new password on the infected machine hands it straight over to the attacker.
Then comes the step that most people skip: terminating active sessions. A new password doesn't necessarily throw out an attacker who holds a valid cookie. You have to end the open sessions separately.
How to End Sessions Across Major Platforms
Google: myaccount.google.com → Security section → "Manage all devices". Every session is listed on its own—tap the device and sign it out. Google doesn't offer a single button for all of them, so you'll need to do this manually for each device.
Microsoft: account.microsoft.com → advanced security options → "Sign out everywhere". According to Microsoft, the sign-out can take up to 24 hours, and the Xbox is excluded—so check your gaming devices separately.
Apple: account.apple.com → Devices section → select the device → "Remove from account". The device shows up again if somebody is still signed in on it.
The Honest Truth About Passkeys
Passkeys are seen as the successor to the password, and the BSI calls them a very secure form of authentication. That's true, but once again it only covers the act of signing in.
A passkey stops somebody from signing in as you. It does not stop somebody from taking over the session you already have open. The sign-in itself remains attackable, as shown by "Pass-the-Passkey" attacks that target the authentication flow itself.
The Uncomfortable Reality
In its security blog of 9 April 2026, Google writes that on no operating system is there a reliable way to prevent cookie theft with software alone once malware sits on the device. What DBSC changes is the shelf life of the loot—the stolen cookie is then only usable on the machine where it was created.
Until that applies everywhere, the awkward part stays with you:
- No cracked software—the risk simply isn't worth it
- Downloads only from original sources—verify the website you're downloading from
- On any suspicion, reinstall the system first and end the sessions afterwards—in that order
The Bottom Line
Session hijacking represents one of the most significant security vulnerabilities in modern computing because it bypasses the authentication methods we've been trained to rely on. While browser makers are working on solutions like DBSC, the protection is currently limited to Google services on Windows.
For everyone else, the burden falls on individual vigilance. Regular sign-outs, cautious downloading habits, and immediate action when you suspect compromise aren't just good practices—they're essential survival techniques in today's threat landscape.
The attackers know this is the path of least resistance. The question is whether you'll be prepared when they try to walk through your door.
This article is based on findings from the Global Threat Intelligence Report by Flashpoint, Europol's Operation Endgame, and security guidance from the German Federal Office for Information Security (BSI) and Google's Chromium security team.
Source : Chromium Blog, Google Security Blog, Chrome for Developers, Google Workspace Updates, Flashpoint Global Threat Intelligence Report 2026, Europol on Operation Endgame, Mozilla Bugzilla 56788, BSI on malware
 |
| Chrome has encrypted cookies since version 127 and ties sessions to the device with DBSC. Firefox still keeps its cookie database unencrypted. |