Your Cookies Are Worth More Than Your Password

Long unique password, multi-factor enabled, everything done right. The attacker never saw the login page because they arrived already signed in.

Hello, I am Nitin.

A client's account was taken over. Their password was long, random, unique to that service, and stored in a password manager. Multi-factor authentication was enabled. They had done everything the advice says.

The attacker never entered the password. The attacker never faced the second factor.

They arrived already logged in.

What a session actually is

When you sign into a service, you prove who you are once. Password, then a code or a prompt. The server then issues you a token, stored as a cookie in your browser, and from that moment on your browser presents that token with every request.

That token is what keeps you logged in. It is the reason you do not authenticate again on every page load, and it is the reason you can close your laptop and come back tomorrow still signed in.

Here is the part that matters. To the server, that token is proof that authentication already happened. It does not re-examine the decision. It does not ask for the password again, and it does not ask for a second factor, because as far as the server is concerned those questions were answered when the token was issued.

So anyone holding a valid session token is you. Not someone who can become you. You.

This is why multi-factor authentication, which is genuinely excellent and which you should absolutely use, does not help here. Multi-factor protects the login. A stolen session skips the login entirely.

How tokens get stolen at scale

There are two routes and both are industrial.

Information-stealing malware. This is the dominant one. A small program that runs on a machine, harvests everything authentication-related it can find, and exfiltrates it. Not just saved passwords. Session cookies for every site, authentication tokens, autofill data, browser fingerprints, cryptocurrency wallet files, messaging app session data, and API keys.

The scale is genuinely hard to absorb. Researchers recorded more than 1.8 billion credentials stolen in a six-month period, from roughly 5.8 million infected devices, described as an 800 percent increase over the preceding months. A separate 2026 report documented 18.1 million exposed API keys and tokens from malware sources alone. In one mid-2026 dataset, over 124 million passwords were added to breach databases, sourced not from any single company breach but from a vast number of individually infected computers.

These tools are fast and quiet by design. Many run entirely in memory, complete the harvest in under a minute, and some variants delete themselves afterwards, leaving very little for endpoint tooling to find. Silence is the feature.

And the output becomes a product. Stealer logs are sold on marketplaces with listings, ratings and subscription tiers. One analysis found that 54 percent of ransomware victims had their domain credentials appear in stealer log marketplaces before the attack landed, sometimes with under 48 hours between the two.

Adversary-in-the-middle phishing. The second route needs no malware at all. Instead of a fake login page that collects your password, the attacker runs a proxy that sits between you and the real site. You see the genuine login page, because it is the genuine login page, relayed. You enter your password. You approve the multi-factor prompt on your phone, correctly, because the login is real. The proxy captures the session token the real service issues, and that is the whole attack.

You did everything right. You approved a prompt for a login you genuinely initiated. The attacker walked away with the session.

Why this is where the industry is going

The collective effect is that the password has quietly stopped being the primary target. Stolen credentials and session data now appear in the large majority of breaches, and they are fresh rather than historic, because they are harvested at the keyboard rather than recovered from an old dump.

The practical implication for you is uncomfortable but simple. Changing your password does not necessarily evict someone who is already inside.

I mentioned this in an earlier post about rebuilding a compromised identity and it deserves saying plainly here. After any credential change on any important account, you must explicitly terminate existing sessions. Most major services have a control for it, often called sign out everywhere or something similar, sometimes buried in security settings. If you do not use it, you may have locked the front door with the intruder still in the house.

What actually reduces this risk

Passkeys. This is the one genuine step change available to ordinary users. A passkey binds authentication to a device and an origin using a private key that never leaves your hardware. It cannot be phished, because there is nothing to type and nothing to relay, and a proxy in the middle cannot obtain a credential the browser will not release to the wrong origin. Where a service offers passkeys, use them, particularly on your email account.

Do not run untrusted software. Boring and it is the actual vector. Most of these infections arrive through cracked software, malicious advertisements, fake installers and browser extensions from unofficial sources. The single highest-risk thing a technically confident person does is install something they found because it was free.

Reduce what your browser is holding. Every saved password and live session in your browser is part of the harvest if that machine is ever compromised. Sign out of things you are not using. Do not save payment details for convenience.

Separate contexts. I keep client work, personal accounts and experimental activity in separate browser profiles. If one is compromised, it does not hand over everything.

Check your exposure. Your addresses will appear in breach corpora. Assume anything found is public permanently and act accordingly.

Shorten sessions where it matters. For your email and financial accounts, the convenience of staying signed in forever is a security decision you are making without noticing.

Conclusion — steal this checklist

• Understand that a session token is proof of a completed login. Anyone holding it is you, and no second factor is asked again.
• After every password change on an important account, use the sign out everywhere control. Otherwise you may not have evicted anyone.
• Enable passkeys where offered, starting with your email. They cannot be phished or relayed.
• Stop installing cracked software, unofficial extensions and installers from search advertisements. That is the primary infection route.
• Reduce what your browser holds: saved passwords you do not need, live sessions you are not using, stored payment details.
• Separate browser profiles for work, personal and experimental use.
• Recognise that approving a legitimate-looking multi-factor prompt does not prove the site is legitimate. The proxy relays the real one.
• Check your addresses against breach databases and treat anything found as permanently public.
• Do not conclude that multi-factor is pointless. It stops enormous numbers of attacks. It just does not stop this one.