Walk through a 4-step attack in 60 seconds. No setup required.
The user does everything right. Strong password, 2FA enabled.
Login successful
Session cookie issued to browser
Any script or malware running on this device can read this cookie directly. Nothing prevents it.
The cookie travels over unencrypted connections. Anyone on the same network could intercept it.
The browser attaches this cookie to every request, even from other websites. No restrictions at all.
Malware like RedLine, Raccoon, and Lumma runs silently after a user opens a phishing attachment or trojanized download. It reads the browser's cookie database directly from disk, an SQLite file sitting unencrypted in the user's profile folder. The entire operation takes under 2 seconds. No browser interaction, no pop-ups, no visible sign. The stolen cookies are sent to the attacker's C2 server, where they're sold on dark web marketplaces or replayed immediately.
An attacker on a completely different device pastes the stolen token into their browser. The server sees a valid session cookie and grants full access. It has no way to know this isn't the original user.