Accessibility links

Facebook   X   LinkedIn   Email

FBI Warns of Cookie Theft Leading to Stolen Email Accounts

By: Jim Stickley and Tina Davis
November 6, 2024

Recently, the FBI issued a warning about cybercriminals increasingly using stolen browser cookies to bypass multi-factor authentication (MFA). They specifically pointed out the theft of said cookies for AOL, Gmail, Outlook, and Yahoo email users. However, don’t be fooled by that. Anyone storing cookies for any website, email or favorite online shopping websites are at risk.

What are cookies? These are little pieces of information about you that store session information such as your login information, shopping cart products, or whatever else the website needs to prevent you from having to log in over and over and over again. You may know this process by the “remember me” checkbox. While convenient, it also leaves you at risk for theft.

Once attackers obtain these morsels of goodness—often by infecting devices with malware or through phishing—they can hijack sessions to impersonate the victim, sidestepping the need for MFA.

The FBI stressed the importance of robust cybersecurity practices to combat these attacks. After all, getting access to your email is valuable to an attacker, especially if you use it to receive your one-time access codes for websites. In addition to that, they can use your email to send out phishing email to your contacts.

The FBI tips include:

  • Clearing browser cookies often. Consider doing this at the end of the day; but at a minimum do it on a regular basis. While a bit cumbersome to re-enter the credentials, it could save you from a cookie sugar high. Better yet, consider not allowing the browser to remember them at all.
  • They also recommended using additional security measures, such as not clicking on suspicious links or websites. This often leads to malware landing on your device a la phishing.
  • Check for the HTTPS, indicating a secure connection, to protect your data from being intercepted during transmission.
  • Even though it’s not foolproof, enable MFA for all websites when available. It may not guarantee your security fully, but it is a Cookie Monster sized help.
  • Consider using passkeys rather than passwords. Many sites are adopting this new technology and using it avoids the need for entering your password multiple times. While again, not 100% secure, it makes it even more difficult for an attacker to get access to your accounts.

The FBI encourages anyone who is a victim of this to report it to the Internet Crimes and Complaint Center (IC3). There is a link for just that on the IC3 website.



Not All Cookies Are Created Equal; Know When Not To Accept Them

Your Security

Not All Cookies Are Created Equal; Know When Not To Accept Them

It seems every webpage you land on these days has an “Accept Cookies” pop-up. After all, what’s the big deal about a few cookies, so we click “Accept” and move on. Well, turns out it’s a bigger deal to accept cookies than most users realize. Thinking twice before you accept them can help keep malicious and zombie cookies off your device, among other things. Who would ever think a few innocent cookies could be a bad thing, but unfortunately, many of them are. READ FULL STORY
Passkeys Make Passwords a Thing of the Past

Your Security

Passkeys Make Passwords a Thing of the Past

Tired of creating and remembering passwords? Aren't we all? Well, now there’s an easier option to do away with all those pesky passwords. They’re called “passkeys”, and the best part is, they’re easier to use and more secure (you can now jump for joy). Passkeys are a type of authentication technology doing away with the risks of traditional logins. Unfortunately, not all websites use them yet, but more are appearing every day. While it's a hip hip hooray for us, finding ways around them is also a big challenge for hackers. READ FULL STORY
Finally! Ways to Log In Without Passwords

Your Security

Finally! Ways to Log In Without Passwords

The time has come. Technology has finally appeared that all but eliminates the need to remember a whole bunch of different passwords. No more hint lists. No more trying to come up with yet another one for each site you use. All of that has finally become unnecessary, mostly. Now, you can use some other way to log in. There are many options and what you choose depends on how you are logging in, what you're using, and your own personal preference. The point is, you have choices. READ FULL STORY
AI-Generated Phishing — The Security Landscape Changes

Scams & Phishing

AI-Generated Phishing — The Security Landscape Changes

Phishing scams, the scourge of businesses everywhere, are getting a facelift thanks to generative AI. Already the reason for 90% of all data breaches, phishing is getting much more difficult to spot thanks to generative AI. Traditional ways of identifying phishing scams are becoming obsolete and businesses are in the crosshairs of this new generation of phishing attacks. That's why creating a more effective response is in the best interest of every organization. READ FULL STORY
AI ChatGPT And PaaS Merge, Further Weaponizing Email Phishing Campaigns

Your Security

AI ChatGPT And PaaS Merge, Further Weaponizing Email Phishing Campaigns

Hold on to your login credentials! A recent look at email phishing campaigns uncovered a 61% spike in attacks over the second half of last year. However, security pros find AI (artificial intelligence) is now accelerating these campaigns, and the number of attacks will significantly increase going forward. With the release of the AI ChatGPT platform coupled with PaaS (phishing-as-a-service) kit upgrades, email phishing is slated to be more pervasive and destructive than ever before. READ FULL STORY




We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.