Most advice about account security is advice about passwords. One of the more common ways accounts are taken over does not involve the password at all.
In session hijacking, an attacker steals the active login session itself and uses it to enter the account. No password is needed, and because no new login takes place, there is often nothing to alert you.
What a session cookie is
A session cookie is a small piece of data a website stores on your device so you do not have to re-enter your password on every page. It is effectively a digital key: whoever holds it is treated as you.
Logging out properly ends the session and invalidates the key. Staying permanently logged in — or just closing the tab without logging out — can leave a session alive for a very long time. That distinction is the whole problem. Closing the tab looks like leaving; it is not.
How the cookies get stolen
Usually from your own device, through malware installed after downloading untrusted software. The category has a name: infostealers, built specifically to harvest saved passwords, session cookies and other sensitive data. The malware finds the active cookies in your browser and sends them to the attacker, who loads them and is inside the session.
The scale is not small. Marijus Briedis, chief technology officer at NordVPN, says cookies have become a major target. The company found 5.2 billion cookies among stolen data circulating online in the year to June.
How you would notice
Often you would not, at least at first. The signs tend to be consequences rather than warnings: messages sent in your name, contacts asked for money, fraudulent links going out to people who trust you, unauthorised access to banking, changed orders or delivery addresses, purchases made with saved payment details. Sometimes the site warns you about an attempted change to your account — but not always.
The device may show it before the account does. Sudden slowdown, rapid battery drain, frequent freezing, unexpected redirects, repeated pop-ups or a changed homepage are all consistent with an infostealer running.
What actually helps
Be careful what you install, including browser extensions, and especially from unknown sources — this is the step that prevents the rest. Log out at the end of a session rather than closing the tab. Do not save passwords in the browser; use a separate password manager. Clear cookies regularly, which limits how many are available to steal. Avoid unsecured public Wi-Fi for banking, though the direct cookie-theft risk there is lower than the other routes.
Turn on multi-factor authentication. It is worth being honest about its limits here: a stolen session cookie can sometimes bypass MFA, because the session was already authenticated. It still removes the much larger category of password-only attacks.
If you think it has happened
Run an antivirus scan first — if the malware is still on the device, everything else you do will be undone. Then log out of all devices, which kills every live session including the stolen one. Change your passwords. Remove unfamiliar devices from your account security settings. If money is involved, contact your bank immediately rather than waiting to confirm the cause.
