You’ve been here a thousand times before, signing into your account as normal: Type your password, grab the 6-digit code from your phone, tap it in, and you are all logged in.
Password? Check. Two-factor Authentication (2FA) code? Check. That has to mean that since no one knows those, no one else can access your account… Right?
Not always. Strong passwords matter and rest assured that 2FA matters too, so keep both of those habits going. However, did you know there are gaps that bad actors can still exploit without bothering about passwords or codes? In today’s article we’ll explain how that works, how infostealer malware reaches everyday devices, and how to help reduce the risk of this type of attack with Avast One Free Antivirus.
Why Session Cookies Are So Valuable To Attackers
One of the most common gaps in account security is cookies, especially the ones that tell browsers “Hey, this person is already logged in.”
They’re called “Session Cookies” and they’re simply small pieces of data that a website leaves in your browser after you’ve successfully logged into it. Its job is simple. It tells the website that you have already proved who you are, so you do not have to keep typing in passwords and two-factor authentication codes all the time.
It’s kind of like the wristband they give you at an event. Initially, you showed your ticket to a member of staff at the entrance to get in. You can walk around the event freely wearing it and no one will question it or kick you out. On a website, that means you stay online without getting kicked out either.
For an attacker, stealing that “wristband” is valuable for proving they belong in your account. With the session cookie in hand, there’s no password prompt, no two-factor authentication challenge, and no direct hacking of your personal data. There’s just a legitimate login session being re-used elsewhere.
It’s important to note when this occurs too. It’s not during two factor authentication or password input. The theft happens after you log in during normal account usage after the session cookie is generated. Some cookies expire quickly, but others can last a very long time, and occasionally they may not even expire at all. That can make them worse than passwords because access can continue indefinitely without intervention.
Most of the time, the attackers don’t even want to use the session cookies, they’ll simply be selling them off for other criminals to use.
How Infostealer Malware Gets Onto Devices
A typical path to this type of attack is via infostealer malware. That’s a program which has been created to silently steal this type of data quickly. This type of malware won’t usually just target session cookies, but also passwords, autofill data, browser history or even crypto wallet data. It’s also not easy to catch because the infostealer may stay for only a few seconds to a few minutes, send out the information, then remove itself without leaving any kind of visible clue behind.
Criminals very often deliver this stolen data in what is known as “logs”, small bundles of stolen info that are then sold to other criminals. Flashpoint reported that, in 2025, infostealers accounted for the theft of 1.8 billion credentials of up to 5.8 million hacked devices. So, there are not a few super-cunning hackers targeting a few unlucky victims. It’s a full-fledged criminal market.
The first infection in most cases looks harmless, typically a result of downloading software from untrusted sources using very convincing download pages. Commonly these are game mods, cheat tools and cracked software, but not always. So the first way to protect yourself is only to download community-vetted software from well-trusted websites.
Another attack vector is through a fake verification page that will ask you to click various prompts to prove you are human, as well as copying, pasting, and then running commands through the Run dialog box on your system. As this type of attack relies on human cooperation to work, the most important thing is to be aware and remember that if you see something similar in the future, and don’t blindly follow CAPTCHA type requests when they clearly overstep on what they’re asking you to do.
Then there’s phishing. Some of these malicious emails and pages don’t just want your password. Some people let their guard down because an email isn’t asking for any personal data, but when clicking through, the site or brand they imitate could install malware to collect the session cookies.
Practical Ways to Reduce Session Cookie Theft Risk
As mentioned, sometimes awareness is the biggest step.
When you consider the vectors we outlined:
- The malware is typically downloaded from sites without strong reputation and vetting.
- Criminals are no longer just looking for you to input data in a form to phish you
- Fake Captchas can use social engineering for malicious ends
Simply being aware of them will help you form good security habits, and your security habits are what will ultimately protect you.
Be more careful with downloads. Avoid sponsored search results, fake “Download” buttons, browser pop-ups, and cracked software where downloads are shadier. Also, if a page is really pushing hard to make you install something, ask yourself “why?”.
For fake captchas, you should never paste commands from a website, email, pop-up, or chat message to “verify you are human.” That’s not normal.
In general though, you should periodically build a habit of logging out from accounts. Find the “sign out of all devices” button when it’s available and make use of it. In the case you were compromised and you never know it, you could cut off that avenue of attack by invalidating the session cookies.
Finally, keep an eye on your accounts for unexpected logouts, login alerts from places you don’t recognise, changes to your account that you didn’t make, or random transactions. If you think you’ve been a victim, change your password right away and then log out of all sessions.
Other Good Security Habits
Always keep 2FA switched on, even if this type of attack is designed to bypass it, it’s still very effective for other attacks. Use a password manager so you are not reusing passwords, consider passkeys where your important services offer them.
On top of that, you make malware infection less likely, reduce the damage in the event something slips through, and have the tools to react if you do think that something suspicious happened.
A tool like Avast One Free Antivirus can fit into this defense because this kind of attack relies on malware running on your device.
Where Avast One Free Antivirus Fits Into This Defense
Avast One Free Antivirus can help reduce the risk, since it tries to identify the parts of the chain of attacks leading to cookie theft: Malicious downloads, dangerous sites, phishing sites, and suspicious behavior. It’s not magic or a miracle. It’s a practical defense tool that will work alongside your security habits mentioned above.
- Real-time threat protection: This helps to detect and block malware and malicious downloads before they can execute. This kind of protection matters, since infostealer malware is the tool criminals use to rip session cookies and save data straight from your system.
- Web Guard: Potentially blocks dangerous and fake sites before they start loading. That can reduce exposure to malicious pages, fake verification pages, or compromised web scripts. AI-powered scam detection and Avast Assistant can help flag suspicious messages, phishing links, and dubious offers—giving you a nudge before you click yourself into a mess.
- Avast Core Shields (File, Behavior and Mail Shield): Another layer of defense through file and email scanning, alerting if apps themselves start acting suspicious and adapting to quickly-evolving threats. Quarantine helps keep unsafe files out of your system while you determine what to do next.
AV-Comparatives named Avast Free Antivirus a “2025 Top-Rated Product” and AVLab named it “Product of the Year 2026”. And since that free antivirus protection is available in the Avast One app, you know you’ve got a good companion helping you maintain your digital security.
Signing In Without Handing Over the Keys
The main change is simple: attackers have moved on to go after what happens after you’ve logged in, not just the password. So keep two-factor authentication in place but remember it isn’t designed to stop every type of attack.
Smart habits, regular session sign-outs, careful downloads, and free device-level protection can all help reduce the risk. As a protection layer, Avast One Free Antivirus is always in place while you browse, download, and open files, which can help to make sure that your signed-in sessions stay where they should.
