What If a Hacker Could Log Into Your Account Without Knowing Your Password?

Imagine this.

You have a strong password.

You use a password manager.

You enabled MFA.

You don’t click suspicious links.

Then one morning:

Someone is inside your account.

You check your password.

It hasn’t changed.

You check your MFA.

It’s still enabled.

You check your email.

There is no suspicious login notification.

So how did they get in?

One possibility is something many people don’t understand:

Your login session may have been stolen.

Instead of stealing your password, an attacker can sometimes steal the session cookie or authentication token that proves to a website that you have already logged in.

The attacker may then attempt to reuse that session as if they were you.

MITRE ATT&CK classifies stolen web session cookies as a credential-access technique and notes that attackers can use them to access web applications as an authenticated user without possessing the underlying credentials. (MITRE ATT&CK)

And here’s the part that makes this particularly concerning:

Some stolen sessions can bypass MFA because the session has already been authenticated.

First: What Is a Cookie?

Don’t worry—this isn’t about the cookies in your kitchen.

A web cookie is a small piece of information that a website stores in your browser.

Cookies have many legitimate purposes.

They can remember things such as:

• Your preferences
• Shopping-cart contents
• Language settings
• Login state
• Session information

The important one here is the session cookie.

What Happens When You Log Into a Website?

Suppose you visit a website.

You enter:

Username
+
Password
+
MFA

The website verifies you.

Instead of asking you for your password on every page, it can create an authenticated session.

Your browser receives information that essentially tells the website:

“This browser has already authenticated successfully.”

Your browser then sends the relevant session information when making subsequent requests.

That’s why you can:

• Open another page
• Refresh the browser
• Navigate around the website

without entering your password every few seconds.

Your Session Is Like a Temporary Digital Wristband

Think about entering a concert.

At the entrance:

Ticket + ID → security check

Once you’re inside, you receive a wristband.

You don’t have to show your ticket every 30 seconds.

The wristband tells security:

“This person has already been admitted.”

A session cookie can work somewhat like that.

Your password and MFA got you through the entrance.

The session represents your already-authenticated state.

Now imagine someone steals the wristband.

They might attempt to use it to enter areas you’re authorized to access.

That’s the basic idea behind session hijacking.

Password Theft vs Session Theft

This distinction is extremely important.

Traditional credential theft

Attacker gets:

Username + Password

Then:

Login → MFA challenge → Account

Session theft

Attacker gets:

Authenticated session/token

Then potentially:

Replay session → Account

The attacker may not need to know your password.

And depending on the service and session controls, they may not trigger the normal authentication process again.

MITRE documents this as “Use Alternate Authentication Material: Web Session Cookie.” (MITRE ATT&CK)

Why This Can Defeat Some MFA

Let’s make something clear:

MFA is still extremely important.

Do not read this article and disable MFA.

The problem is simply that MFA normally protects the authentication event.

If the attacker obtains a session after you’ve authenticated, the attacker may attempt to reuse that already-authenticated session.

MITRE explicitly notes that stolen session cookies can bypass some MFA protocols because the session is already authenticated. (MITRE ATT&CK)

So the attack isn’t necessarily:

“Guess the password.”

It’s:

“Steal the authenticated state.”

This Is Why Infostealers Are So Dangerous

This connects directly to the previous SpyBoy article about infostealer malware.

An infostealer running on your computer may search for valuable browser information, including session cookies.

MITRE documents browser-cookie theft as an established technique and notes that cookies can be obtained from browser storage or memory. (MITRE ATT&CK)

That’s why an infection can be much more serious than:

“Someone stole one of my passwords.”

The attacker may potentially obtain:

Passwords

Cookies

Authentication tokens

Autofill information

Other application data

What Does the Attack Look Like?

At a high level:

You log into your account

↓

Your browser receives an authenticated session

↓

Malware or another attack obtains session material

↓

Attacker obtains the session

↓

Attacker attempts to replay it

↓

Website sees a valid authenticated session

↓

Attacker may gain access

The exact behavior depends on the website’s authentication architecture and security controls.

How Can Someone Steal a Session?

There isn’t just one method.

1. Infostealer Malware

This is one of the biggest concerns for ordinary users.

You download:

• Cracked software
• Fake updates
• Pirated games
• Malicious tools
• Fake browser extensions
• Malware disguised as legitimate software

The malware runs.

It searches for valuable browser data.

Session cookies can be among the targets.

2. Phishing

Modern phishing isn’t always about stealing your password.

Attackers can build phishing infrastructure designed to capture authentication material or relay authentication in real time.

MITRE identifies adversary-in-the-middle techniques and phishing infrastructure as methods that can be used to obtain session cookies. (MITRE ATT&CK)

This is one reason:

“The website looked exactly like the real one.”

isn’t necessarily proof that you’re safe.

3. Malicious Browser Extensions

A browser extension can potentially receive powerful permissions depending on what it requests and what the browser allows.

Installing a random extension simply because:

“It gives you free Netflix.”

or:

“It downloads any YouTube video.”

can create unnecessary risk.

Only install extensions you actually need and review their permissions.

4. Compromised Computers

If someone has sufficiently deep access to your computer, they may be able to target browser data or other authentication material.

MITRE’s detection guidance specifically includes monitoring suspicious access to browser cookie storage and browser processes. (MITRE ATT&CK)

5. Compromised Websites or Applications

Session information can potentially be exposed through vulnerabilities in applications or infrastructure.

The Citrix NetScaler vulnerability CVE-2023-4966, for example, was used to obtain valid session cookies from vulnerable systems; Google Cloud’s threat-intelligence analysis described attackers using those cookies to establish authenticated sessions without the username, password or MFA device. (Google Cloud)

This demonstrates an important point:

Session theft isn’t only an “individual user clicked malware” problem.

It can also involve vulnerabilities in infrastructure.

What Can an Attacker Do With a Stolen Session?

The answer depends entirely on what the session represents and what permissions the account has.

Potentially, an attacker may be able to:

• Read information
• Access email
• View private messages
• Modify account settings
• Perform actions available to the account
• Access cloud resources
• Download information
• Impersonate the user
• Attempt password/MFA changes

MITRE specifically notes that an attacker using a stolen session can access sensitive information and perform actions the victim’s account is authorized to perform. (MITRE ATT&CK)

Imagine This Happening to Your Gmail

You log into Gmail.

Your session is authenticated.

Someone obtains that session.

They may potentially access your mailbox without knowing:

Your password.

That’s dangerous because email is often the reset key for your entire digital life.

From email, attackers may find:

• Password-reset emails
• Shopping receipts
• Financial information
• Private conversations
• Work documents
• Account notifications
• Recovery links

That’s why protecting your email session is extremely important.

What About Discord?

A compromised Discord session could potentially give an attacker access to an account without them knowing your password.

That could allow them to:

• Send messages
• Impersonate you
• Contact your friends
• Join or interact with servers
• Attempt scams using your identity

This is one reason you shouldn’t assume:

“My password wasn’t changed, so my Discord account is safe.”

What About Social Media?

A stolen session could potentially allow access to:

• Instagram
• Facebook
• X
• LinkedIn
• Other platforms

The attacker could potentially use your account to:

Become you.

And your friends may trust messages coming from your account.

What About Work Accounts?

This is where session theft becomes particularly serious.

Suppose an employee has access to:

• Microsoft 365
• Google Workspace
• Slack
• GitHub
• AWS
• Internal SaaS applications

A stolen session could potentially provide access to resources available to that user.

Now the incident isn’t just:

“John’s Facebook was hacked.”

It could become:

“Our company cloud account was compromised.”

Google Cloud’s 2026 Cloud Threat Horizons report notes cases where stolen credentials/tokens were used to access repositories and then discover further secrets for downstream compromise. (Google Cloud)

The Scary Part: You May Not Get a Password-Changed Alert

Many users expect:

“Someone changed my password.”

But a session attacker may not need to change your password.

That’s why you need to pay attention to other signs.

Signs Someone May Have Hijacked Your Session

Watch for:

🚩 Unknown active sessions

Your account shows a device you don’t recognize.

🚩 Unexpected locations

Your account appears active somewhere you weren’t.

🚩 Strange browser/device information

A session appears from an unfamiliar environment.

🚩 Unexpected account activity

Messages, posts or actions you didn’t perform.

🚩 Emails marked as read

You didn’t read them.

🚩 Account settings changed

Recovery information or preferences suddenly change.

🚩 MFA changes

A new authentication method appears.

🚩 Multiple accounts become compromised

This can suggest a broader device compromise.

But Location Alone Isn’t Proof

Be careful.

IP geolocation isn’t perfectly accurate.

VPNs, mobile networks, corporate networks and cloud services can make a login appear to come from a different location.

So:

“Login from another city = hacker”

isn’t necessarily true.

Look for patterns, not one isolated signal.

What If You Get a “New Login” Alert?

Don’t ignore it.

Ask:

Was that me?

If yes:

Nothing may be wrong.

If no:

Investigate immediately.

Don’t wait until tomorrow.

What Should You Do If You Think Your Session Was Stolen?

This is the most important part.

Step 1 — Stop Using the Suspected Device for Sensitive Accounts

If you think malware may be responsible, don’t keep logging into:

• Email
• Banking
• Crypto
• Work
• Password manager

from that machine.

Use a known-clean device where possible.

Step 2 — Change Your Password

Use a trusted device.

Start with the most important account—usually your primary email.

Then change passwords for other critical accounts.

Step 3 — Sign Out Everywhere

This is extremely important.

Look for:

• Sign out of all sessions
• Log out everywhere
• Terminate active sessions
• Remove devices
• Revoke sessions

The exact wording differs between services.

The goal is:

Invalidate the attacker’s existing session.

Step 4 — Revoke Connected Applications

Check:

Settings → Security → Connected Apps

Remove applications you don’t recognize.

This is particularly important for OAuth-connected services.

Step 5 — Check MFA

Review:

• Authenticator apps
• Security keys
• Backup methods
• Recovery email
• Recovery phone
• Trusted devices

Remove anything you don’t recognize.

Step 6 — Check Your Email Rules

This is often overlooked.

An attacker who accessed your email may create:

• Forwarding rules
• Filters
• Automatic deletion rules
• Mailbox delegation

For example:

"If email contains 'security alert'
→ forward it elsewhere"

That can help an attacker hide future account activity.

Step 7 — Check Recent Account Activity

Look for:

• Unknown logins
• Password changes
• New devices
• New apps
• Security-setting changes
• Messages you didn’t send
• Files you didn’t download

Take screenshots if you discover suspicious activity.

Step 8 — If Malware Is Suspected, Clean the Device

Don’t just change your password and immediately continue using the infected machine.

If malware remains active, it could potentially steal new credentials or sessions.

Use reputable security software and consider a clean OS reinstall if compromise is serious.

For a business device:

Contact IT/security before wiping it.

They may need the machine for investigation.

Step 9 — Monitor Financial Accounts

If the compromised account contained:

• Payment information
• Banking information
• Crypto
• Financial documents

monitor those accounts carefully.

“Should I Change My Password Again?”

If you change your password from an infected computer, potentially yes.

The safer approach is:

Clean/trusted device → password change → revoke sessions → verify MFA.

Why “Change Your Password” Isn’t Always Enough

Imagine:

Password stolen

→ Change password

Potentially solved.

But:

Session stolen

→ Change password

→ Existing session may still need to be revoked.

That’s why account recovery after suspected session theft should include:

Credential rotation + session invalidation.

Does Logging Out Protect You?

Usually, logging out can invalidate a session.

But don’t assume every service handles sessions identically.

If you suspect compromise, use the service’s explicit:

“Sign out everywhere”

or:

“Revoke all sessions”

feature if available.

Does Clearing Cookies Protect You?

Clearing cookies on your own browser can terminate your local sessions.

But if an attacker has already copied a session cookie, clearing your local cookie doesn’t necessarily erase the attacker’s copy.

That’s why:

Server-side session revocation matters.

Should You Delete All Cookies Every Day?

Probably not necessary for most people.

MITRE recommends reducing the lifetime of persistent cookies as one mitigation, but cookie management should balance security and usability. (MITRE ATT&CK)

A better strategy is:

• Keep software updated
• Use secure authentication
• Avoid malware
• Review sessions
• Use MFA
• Sign out of sensitive services when appropriate
• Use browsers with strong security protections

Does Incognito Mode Prevent Cookie Theft?

No.

Private browsing isn’t a malware-defense mechanism.

If malicious software is running on your computer with sufficient access, Incognito doesn’t magically make the machine trustworthy.

Does a VPN Prevent Session Hijacking?

No.

A VPN can protect certain network traffic/privacy aspects.

But it doesn’t stop malware running on your own device from potentially targeting browser data.

Does HTTPS Protect You?

HTTPS is extremely important.

But HTTPS doesn’t protect against:

Malware running inside your computer.

If the browser itself is compromised or session information is stolen locally, the encryption between you and the website isn’t the main problem.

Does MFA Make You Safe?

MFA makes you much safer.

But it isn’t absolute protection against every attack.

MITRE specifically documents stolen web-session cookies as a way adversaries can sometimes reuse an authenticated session without going through the normal authentication process again. (MITRE ATT&CK)

So don’t think:

MFA = impossible to hack.

Think:

MFA = one extremely important security layer.

What Is Better Than SMS MFA?

Where supported, stronger phishing-resistant authentication methods such as passkeys/security keys can provide additional protection.

MITRE specifically notes hardware-based authentication and conditional-access policies as mitigations for session-cookie replay scenarios in enterprise environments. (MITRE ATT&CK)

Google has also been developing Device Bound Session Credentials (DBSC), designed to cryptographically bind authenticated sessions to a particular device, specifically to reduce the usefulness of stolen cookies. (Google Cloud)

This is an important direction for the future:

Make stolen cookies useless outside the device that created them.

What Are Device-Bound Sessions?

Traditional session:

Login → Cookie → Browser

Potential problem:

Cookie stolen → attacker attempts reuse

Device-bound session:

Login → Cryptographically bound session → Specific device

If the session material is copied elsewhere, the attacker should have a much harder time replaying it.

This is an emerging defense rather than something you should assume every website currently supports.

How Businesses Can Detect Session Hijacking

This isn’t just for ordinary users.

Security teams can monitor for:

• Session reuse from unusual IP addresses
• Impossible travel
• New device fingerprints
• User-agent changes
• Session use without corresponding authentication
• Concurrent sessions from distant locations
• Token use from unmanaged devices

MITRE’s current detection guidance specifically recommends looking for session-token reuse without corresponding login/MFA activity, unusual locations and device/browser changes. (MITRE ATT&CK)

A Simple Example

Imagine:

8:00 AM

You log into Microsoft 365 from Delhi.

8:02 AM

Your session is stolen.

8:15 AM

The same session appears from another country.

There was no normal authentication event.

That’s suspicious.

Modern security systems can correlate those events.

What If the Hacker Is Using Your Exact Browser?

That can make detection harder.

Attackers may attempt to make their traffic resemble normal user activity.

That’s why modern detection isn’t based on IP address alone.

It can consider:

• Device
• Browser
• IP
• Location
• Session behavior
• Authentication history
• Timing
• Application behavior

Session Hijacking vs Session Fixation

These terms sound similar but aren’t identical.

Session hijacking

Attacker obtains an existing valid session.

Session fixation

Attacker attempts to make a victim use a session identifier that the attacker already knows or controls.

Both involve session management, but they’re different attack concepts.

For ordinary users, the main lesson is:

Treat your authenticated session as sensitive.

Why Developers Need to Care About This

If you’re building a web application, don’t treat session cookies as harmless browser data.

They are authentication material.

Security practices include:

• Secure cookie attributes
• HttpOnly
• Secure
• Appropriate SameSite configuration
• Short session lifetimes where appropriate
• Session rotation
• Server-side revocation
• Reauthentication for sensitive actions
• Device/risk-based controls
• Strong session management

The exact configuration depends on the application architecture.

HttpOnly Does Not Solve Everything

You may have heard:

“Use HttpOnly cookies.”

That’s good practice.

An HttpOnly cookie isn’t directly accessible to normal page JavaScript.

But that doesn’t make it impossible for malware or other attacks to compromise sessions.

Cookie theft can involve browser storage, memory, malicious software, or adversary-in-the-middle techniques.

MITRE documents multiple paths to session-cookie theft. (MITRE ATT&CK)

So:

HttpOnly = useful defense

not:

HttpOnly = impossible to steal.

What About Secure Cookies?

Secure tells the browser to send the cookie over secure connections.

That’s important.

But again:

It doesn’t protect against malware stealing the authenticated session from the endpoint.

The Most Dangerous Combination

Imagine this:

1. You download cracked software.

↓

2. Infostealer runs.

↓

3. Browser credentials are stolen.

↓

4. Session cookies are stolen.

↓

5. Attacker uses the sessions.

↓

6. Password reset emails are accessed.

↓

7. More accounts are compromised.

This is why the previous article and this article belong together.

How to Protect Yourself

🛡️ 1. Stop Installing Cracked Software

This is one of the highest-value things you can do.

🛡️ 2. Keep Your Browser Updated

Use official update mechanisms.

🛡️ 3. Keep Security Software Enabled

Don’t disable protection just because an installer asks you to.

🛡️ 4. Use MFA

Especially for:

• Email
• Banking
• Cloud
• Social media
• Developer accounts

🛡️ 5. Prefer Passkeys/Security Keys Where Available

Especially for high-value accounts.

🛡️ 6. Review Browser Extensions

Delete unnecessary extensions.

🛡️ 7. Review Active Sessions

Every few months—and immediately if something looks suspicious.

🛡️ 8. Use Unique Passwords

This prevents one stolen credential from becoming many.

🛡️ 9. Keep Your Operating System Updated

Security vulnerabilities can provide attackers with additional ways into your device.

🛡️ 10. Don’t Run Random Commands From Websites

Especially:

“Press Win+R.”

“Paste this into PowerShell.”

“Run this command to fix the error.”

This has become a common social-engineering pattern.

Your 5-Minute Account Security Audit

Open your most important account right now.

Go to:

Security

Then check:

Devices

Do you recognize every device?

Sessions

Are there unexpected sessions?

MFA

Do you recognize every authentication method?

Recovery

Is the recovery email/phone yours?

Connected Apps

Do you recognize everything?

Recent Activity

Are there suspicious events?

Repeat for your:

Primary email

Password manager

Google/Microsoft/Apple account

Social media

Financial accounts

If You Think You’ve Been Hacked

Don’t panic.

Do this:

1. Use a clean device

↓

2. Change important passwords

↓

3. Revoke all sessions

↓

4. Remove unknown devices

↓

5. Check MFA

↓

6. Check recovery information

↓

7. Check email forwarding

↓

8. Check connected apps

↓

9. Scan/reinstall the suspected device

↓

10. Monitor your accounts

The Biggest Mistake You Can Make

You discover:

“Someone logged into my account.”

You change the password.

Then continue using the same potentially infected computer.

If malware is responsible, you may simply be giving the attacker another opportunity to steal the new credentials or session.

Clean the source of the compromise.

Then rotate your credentials and sessions.

Final Thoughts

For years, cybersecurity advice was simple:

“Use a strong password.”

Then:

“Turn on MFA.”

Both remain good advice.

But modern account attacks are becoming more sophisticated.

Attackers don’t always need to know your password.

They may try to steal the thing that tells a website:

“This user has already authenticated.”

That’s your session.

And once that session is stolen, the attacker may attempt to walk through the digital door without going through the login process again.

MITRE currently tracks both Steal Web Session Cookie (T1539) and Use Alternate Authentication Material: Web Session Cookie (T1550.004) as established adversary techniques. (MITRE ATT&CK)

The good news is that you can significantly reduce your risk.

Don’t install random software.

Keep your system updated.

Use MFA.

Prefer phishing-resistant authentication where available.

Be careful with browser extensions.

Monitor active sessions.

And if you suspect an infostealer:

Don’t just change your password.

Use a clean device.

Change credentials.

Revoke sessions.

Check MFA.

Secure your accounts.

Then deal with the compromised computer.

Because your password isn’t the only thing protecting your account anymore.

Your authenticated session is valuable too.

And in the modern internet, sometimes the attacker doesn’t need to steal the key.

They just need to steal the wristband.