Multi-factor authentication (MFA) is excellent at securing the front door. It verifies your identity when you sign in, making sure it's really you. But what happens after you're already inside? Once you've proven who you are, the server gives your browser a session token, usually in the form of a cookie. This token acts like a temporary hall pass. For the duration of your session, your browser shows this pass to the server for every action you take, so you don't have to log in repeatedly.

This is where a critical vulnerability emerges. If an attacker can steal that active session token, they don't need your password or your MFA device. They can present the stolen token to the server, and the server will treat them as the already-authenticated user. They walk right past the security guard because they have a valid pass in their hand.

This technique is known as a Pass-the-Cookie attack, and it's a common way to hijack an authenticated session. The goal isn't to break the authentication process but to sidestep it entirely. To do this, attackers need to get their hands on the cookie file stored on your computer.

Browsers like Google Chrome store this sensitive data in local files on your machine. The session tokens are kept in a SQLite database file, often named simply 'Cookies'. Malicious software is designed to hunt for these specific files, copy them, and send them back to the attacker.

This is the primary function of infostealer malware. Strains like RedLine and Vidar are not designed to encrypt your files for ransom. Instead, they operate silently, sniffing out and exfiltrating valuable data. Their targets include browser databases, cryptocurrency wallets, and other application data that contains credentials or tokens.

You might wonder why these sessions don't just expire immediately. Service providers have to balance security with user convenience. If sessions were too short, you'd be forced to log in constantly. Google, for example, uses persistent session tokens that can remain valid for extended periods, even after you close your browser. This convenience is what attackers exploit.

Some systems try to mitigate this risk through methods like IP address binding, where a session token is tied to the IP address that initiated it. If the token is suddenly used from a different location, the server can invalidate it. However, this defence isn't foolproof. Attackers can use proxies or compromised machines in the same geographic area to bypass these checks.