Skip to main content

Hackers are using cookies to sidestep two-factor authentication

“Cookie stealing” is among the latest trends in cybercrimes that hackers are using to bypass credentials and access private databases, according to Sophos.

Typical security advice for organizations has been to move their most sensitive information to cloud services or to use multifactor authentication (MFA) as a safety means. However, bad actors have figured out how to swipe cookies connected to login details and replicate them to hack the active or recent web sessions of programs that are not commonly refreshed.

A large monitor displaying a security hacking breach warning.
Stock Depot / Getty Images

These hackers are able to exploit several different online tools and services, including browsers, web-based applications, web services, malware-infected emails, and ZIP files.

Recommended Videos

The most insidious aspect of this style of hacking is that cookies are so widely used that they can help nefarious users access systems even if safety protocols are in place. Sophos noted that the Emotet botnet is one such cookie-stealing malware that targets data in the Google Chrome browser, such as stored logins and payment card data, despite the browser’s affinity for encryption and multifactor authentication.

On a broader scale, cybercriminals can purchase stolen cookies data, such as credentials from underground marketplaces, the publication said. The login details for an Electronic Arts game developer ended up on a marketplace called Genesis, which was reportedly purchased by the extortion group Lapsus$. The group was able to replicate EA employee login credentials and ultimately gain access to the company’s networks, stealing 780 gigabytes of data. The group collected game and graphics engine source code details that they used to try to extort EA.

Similarly, Lapsus$ hacked the databases of Nvidia in March. Reports claimed the breach might have revealed the login information of more than 70,000 employees, in addition to 1TB of data from the company, including schematics, drivers, and firmware details. However, there is no word as to whether the hack was due to cookie stealing.

Other cookie-stealing opportunities might be easy to crack if they are software-as-a-service products, such as Amazon Web Services (AWS), Azure, or Slack. These can start with hackers having basic access but tricking users into downloading malware or sharing sensitive information. Such services tend to remain open and running persistently, meaning their cookies don’t expire often enough to have their protocols to be sound security-wise.

Sophos notes that users can regularly clear their cookies to maintain a better protocol; however, that means having to reauthenticate each time.

Fionna Agomuoh
Fionna Agomuoh is a Computing Writer at Digital Trends. She covers a range of topics in the computing space, including…
Lapsus$ hackers convicted of breaching GTA 6, Nvidia, and more
A hacker typing on an Apple MacBook laptop, which shows code on its screen.

The Lapsus$ hacking gang caused havoc in 2021 and 2022 with a series of high-profile security breaches and ransom demands. Yet things have been very quiet since then, and two alleged members of the group have just been convicted in the U.K., potentially bringing an end to one of the most notable hacking sprees in recent times.

According to Bloomberg and the BBC, two people accused of being members of the gang were convicted in the U.K. of a number of crimes, including serious computer misuse, blackmail, and fraud. The defendants included Arion Kurtaj, 18, and a 17-year-old male who could not be named due to his age. Both defendants are autistic and psychiatrists deemed that Kurtaj was not fit to stand trial, so he did not give evidence. They will both be sentenced at a later date.

Read more
Hackers are using AI to create vicious malware, says FBI
A hacker typing on an Apple MacBook laptop while holding a phone. Both devices show code on their screens.

The FBI has warned that hackers are running wild with generative artificial intelligence (AI) tools like ChatGPT, quickly creating malicious code and launching cybercrime sprees that would have taken far more effort in the past.

The FBI detailed its concerns on a call with journalists and explained that AI chatbots have fuelled all kinds of illicit activity, from scammers and fraudsters perfecting their techniques to terrorists consulting the tools on how to launch more damaging chemical attacks.

Read more
Ransomware attacks have spiked massively. Here’s how to stay safe
A hacker typing on an Apple MacBook laptop while holding a phone. Both devices show code on their screens.

No one wants to fall victim to ransomware, but a new report from blockchain security firm Chainalysis claims that ransomware payments could be set for a record-breaking year, with criminals raking in close to half a billion dollars just seven months into 2023.

According to the analysis, ransomware payments this year have totaled $449.1 million so far. That’s $175.8 million more than this time last year, suggesting that hackers have doubled down on this method of extracting money from unfortunate victims.

Read more