Session cookie theft

How it works

After you sign in, a website gives your browser a session cookie so that it does not ask for your password on every page. MITRE ATT&CK describes the technique as stealing web session cookies to gain authenticated access without needing credentials, and notes that cookies are often valid for a long time, even if the application is not actively used.

Attackers obtain cookies in several ways: extracting them from disk, browser memory or network traffic, injecting malicious JavaScript into websites, using malicious proxies in phishing campaigns, and deploying malware. MITRE lists infostealers such as Lumma, RedLine and Raccoon among the tools that take cookies from browsers.

How it shows up in executive exposure

A stolen cookie can bypass the password and a previously completed multi-factor step, because the service already considers the session authenticated. That makes it attractive against executives, whose email and cloud accounts are valuable. Cookies are usually captured together with other data in a stealer log.

EDG3, WebThreat's threat intelligence for leaked data, watches the channels where stealer logs, and the cookies inside them, are posted and sold. CEM shows which executives already appear in breach corpora and leak databases. For how a stolen session changes the response to a leak, see combolists vs stealer logs vs database dumps.

How to reduce the risk

MITRE lists these mitigations:

• Use hardware-based multi-factor authentication such as FIDO keys, which include domain information and so resist proxy-based cookie theft.
• Configure browsers to delete persistent cookies regularly and limit cookie lifespan.
• Train users to recognize phishing and avoid running untrusted JavaScript.
• Audit sign-in activity for impossible travel and other anomalies.
• Keep browsers and password managers updated.
• Disable third-party cookies and limit browser extensions.

If a cookie is believed stolen, signing out all sessions and revoking tokens at the service is the direct response.

How it differs from related terms

Stealing a password gives a credential that can be used again and again, while a cookie gives a live session that expires. A credential pair is a username and password. Account takeover is the outcome, and cookie theft is one route to it. An infostealer is the malware that often does the theft.