Why is a session cookie as valuable as a password?
When you successfully complete your password and second verification step on a web service, the browser receives a temporary session record. This record allows the service to recognize the account as yours without asking for your password again on every page. If an attacker obtains a valid session cookie or access token, some services may allow them to act on your behalf without knowing your password or even entering a new verification code.
That is why the assumption “my password is unique and two-factor authentication is enabled, so I am completely safe” is no longer sufficient. In its Storm-2755 investigation published in April 2026, Microsoft explains how attackers used fake Microsoft 365 sign-in pages to capture both credentials and session tokens, then used the hijacked sessions for financial purposes that included changing payroll information. Google, meanwhile, reported in its 2025 assessment that the distribution of infostealers by email increased by 84 percent during 2024.
Distinguish between the two main attack paths
The first path is malware known as an infostealer. Software delivered as a pirated application, fake update, game cheat, email attachment, or untrusted browser extension can extract browser cookies, saved passwords, and cryptocurrency wallet data. An incident like this may affect not just one account but every service currently open in that browser.
The second path is adversary-in-the-middle phishing. The user opens a sign-in page that closely resembles the real one, while the fake site acts as a proxy between the user and the legitimate service. As the entered password and verification step are forwarded to the real service, the attacker also captures the resulting session record. A page that looks flawless is not necessarily trustworthy; the domain name and how the sign-in process was initiated matter more.
A protection plan for everyday use
Instead of accessing important accounts through links in emails or messages, use a saved bookmark, the official app, or type the address yourself. Do not begin a corporate sign-in by clicking an advertisement in search results. A password manager failing to autofill on the expected domain is also a strong warning. If that happens, close the page instead of entering your information manually.
Use a passkey or FIDO2 security key on accounts that support them. They provide stronger protection against traditional phishing tied to fake domains than SMS codes or approval notifications. However, if malware on the device can read an existing session cookie, a passkey alone may not be enough. Keeping the operating system, browser, and security software up to date, avoiding pirated software, and removing unnecessary extensions are essential parts of the same defense.
Keep work accounts separate from the everyday browsing profile on your personal computer. Organizations should allow access to sensitive applications only from up-to-date, managed devices that meet their security requirements, and should not use administrator accounts for routine email and web browsing. Controls that limit session duration, require reauthentication for risky sign-ins, and bind sessions to devices make it harder to use a stolen record on another device.
How should you investigate suspicious signs?
On the account security page, check for devices you do not recognize, unusual locations, and newly granted app permissions. In your email account, look for forwarding rules you did not create, deleted security notifications, or messages you did not send. File-sharing links, payment details, the recovery address, and the phone number should also be reviewed. Remember that location information may be misleading because of a VPN or mobile carrier; assess the device, time, browser, and action signals together.
The correct response order after an incident
First, disconnect the suspicious device from the internet and, if possible, recover the account from another clean, up-to-date device. Do not stop at changing the password: use the service’s option to sign out of all devices, terminate sessions, or revoke tokens. Remove passkeys, app passwords, OAuth connections, and recovery methods you do not recognize, then set a new, unique password.
Run a security scan on the suspicious device. If the source of the malware is unclear, a clean installation may be the most reliable option. When backing up personal files, do not transfer executable files or unknown archives. Review each email, social media, shopping, cloud storage, and financial account that was open in the same browser. If a work account was affected, notify the IT or security team immediately. The attacker’s mail rules, file access, and activity in corporate applications should be investigated through the logs.
Finally, monitor banking activity and account alerts. Attackers may not use a stolen session immediately. Tracking new sign-ins, password-reset messages, and unexpected verification requests for several weeks after the incident increases the likelihood of detecting delayed abuse.
Research sources
Microsoft Security Blog — Storm-2755 session hijacking and payroll redirection attack: https://www.microsoft.com/en-us/security/blog/2026/04/09/investigating-storm-2755-payroll-pirate-attacks-targeting-canadian-employees/
Google Workspace Blog — Passkeys, infostealers, and device-bound session credentials: https://workspace.google.com/blog/identity-and-security/defending-against-account-takeovers-top-threats-passkeys-and-dbsc