Skip to main content

Warning: Hackers could take over your email account by stealing cookies, even if you have multi-factor authentication (MFA)

 



Posted: November 5, 2024 by Pieter Arntz

The Federal Bureau of Investigation (FBI) has issued a warning that cybercriminals are taking over email accounts via stolen session cookies, allowing them to bypass the multi-factor authentication (MFA) a user has set up.

Here’s how it works.

Most of us don’t think twice about checking the “Remember me” box when we log in. When you log in and the server has verified your authentication—straight away or after using MFA–the server creates a session and generates a unique session ID. This session ID is stored in a session cookie (or a “Remember-Me cookie” as the FBI calls it) on your browser, which is typically valid for 30 days.

Every time you return to that website within the time frame, you don’t need to log in. That’s really convenient… unless someone manages to steal that cookie from your system.

If someone steals the session cookie, they can log in as you—even if you have MFA enabled.

This is particularly relevant for email handlers that have an online—webmail—component. This includes major players like Gmail, Outlook, Yahoo, and AOL.

With access to your email account, a cybercriminal can find a lot of useful information about you, such as where you bank, your account numbers, your favorite shops, and more. This information could then be used for targeted cyberattacks that only mention information relevant to you, leaving you more likely to fall for them.

Cybercriminals could use your account to spread spam and phishing emails to your contacts. And perhaps most worrying of all, once an attacker is in your email account they can reset your passwords to your other accounts and login as you there too.

How do these criminals get their hands on your session cookies? There are several ways.

On very rare occasions, session cookies can be stolen by you visiting a malicious website, or via a Machine-in-the-Middle (MitM) attack where a cybercriminal can intercept traffic and steal cookies if they’re not protected by HTTPS on an unsecured network.

However, session cookies are usually stolen by malware on the your device. Modern information-stealing malware is capable of, and even focuses on, stealing session cookies as part of its activity.  

How to keep your email account safe

There are a few things you can do to stay safe from the cookie thieves:

  • Use security software on every device you use.
  • Keep your devices and the software on them up to date, so there aren’t any known vulnerabilities on them.
  • Decide whether you think it’s worth using the Remember me option. Is convenience worth the risk in this situation?
  • Delete cookies, or—even better—log out when you are done. That should also remove or invalidate the session ID from the server, so nobody can use it to log in, even if they have the session cookie.
  • Only visit sites with a secure connection (HTTPS) to protect your data from being intercepted during transmission.
  • For important accounts regularly check the log in history where you can see which devices logged in when and from where. You should be able to find this option in your account settings.

Comments

Post a Comment

Please no profanity or political comments.

Popular posts from this blog

Three-Quarters of Consumers Familiar With CUs, But Just 1 in 4 Says a CU is PFI, & Other New Findings

WASHINGTON– More than three-quarters of U.S. consumers said they are familiar with credit unions and hold a positive impression, yet just one-in-four banks primarily with a credit union, a new survey has found. The 2026 Credit Union Consumer Perception Report from  CUCollaborate  surveyed 1,000 consumers across the U.S. in December 2025 to gauge their opinions on credit unions. It further found early 70% describe credit unions as trustworthy, and a majority recognize their advantages in fees and rates compared to traditional banks.  But positive sentiment is in decline with younger bankers, according to CUCollaborate. Gen Z consumers represented a sharp shift in credit union perception from older generations, the company said, noting that among those respondents, 36% indicated they had only heard the term “credit union” without having a deeper understanding or had never heard of the term at all.  Some “44% said they were somewhat familiar with credit unions, and a me...
Post a Comment
Read Complete Article HERE>»

Small credit union closures and mergers.

NCOFCU Podcast on the loss of small creditunions. Grant Sheehan CCUE | CEO-NCOFCU examines the rapid decline of small credit unions, why each closure matters to communities, and the threat this trend poses to the cooperative identity and tax protections of the movement. The episode explores practical solutions: larger credit unions acting as stewards, collaboration through shared resources and technology, and the advocacy work of the National Council of Firefighter Credit Unions to amplify every credit union's voice. Listen for a call to action on preserving community-focused financial cooperatives and strengthening the future of the credit union movement. Be sure to visit NCOFCU's "First Responders Credit Unions Academy" for your continued credit union education and certification in meeting N C U A’s requirements.  ================================================= Remember, you're not alone with  NCOFCU.org Join/Upgrade Check out some of NCOFCU's additional f...
Post a Comment
Read Complete Article HERE>»

No Change! Federal Reserve issues FOMC statement

  January 28, 2026 Federal Reserve issues FOMC statement For release at 2:00 p.m. EST Share Available indicators suggest that economic activity has been expanding at a solid pace. Job gains have remained low, and the unemployment rate has shown some signs of stabilization. Inflation remains somewhat elevated. The Committee seeks to achieve maximum employment and inflation at the rate of 2 percent over the longer run. Uncertainty about the economic outlook remains elevated. The Committee is attentive to the risks to both sides of its dual mandate. In support of its goals, the Committee decided to maintain the target range for the federal funds rate at 3‑1/2 to 3‑3/4 percent. In considering the extent and timing of additional adjustments to the target range for the federal funds rate, the Committee will carefully assess incoming data, the evolving outlook, and the balance of risks. The Committee is strongly committed to supporting maximum employment and returning inflation to its 2 p...
Post a Comment
Read Complete Article HERE>»

New FRCUA Manuals Alert!

New & Updated Manuals Now in the First Responder Credit Union Academy! NCUA "What you Need to Know." Building a Budget Policies & Procedures CEO Strategic Planning Checklist Board Strategic Priorities Directors'  Strategic Planning Checklist We’re always improving the First Responder Credit Union Academy to give you the tools you need to succeed. Our manuals are regularly updated with the latest insights, best practices, and industry guidance — so you can stay informed, confident, and ready to serve your members. Check out the latest updates and keep your skills sharp:  https://www.ncofcu.org/first-responder-credit-union-academy  ================================================= Remember, you're not alone with  NCOFCU.org Join/Upgrade Check out some of NCOFCU's additional features: First Responder Credit Union Academy Financial Literacy Podcasts YouTube Mini's Blog Job Board  
Post a Comment
Read Complete Article HERE>»

Long-Stalled Credit Card Competition Act Moves Forward In Senate Clarity Act Markup

WASHINGTON—A long-stalled bipartisan push to boost competition in the credit card market moved closer to becoming law late Friday, as Sens. Roger Marshall (R-KS) and Dick Durbin (D-IL) advanced a new amendment attached to the Senate Agriculture Committee’s markup of the Digital Asset Market Structure and Investor Protection Act, commonly known as the Clarity Act. Dick Durbin The amendment, a core component of the long-debated Credit Card Competition Act, would prohibit major credit-card networks and large issuing banks from enforcing network exclusivity on credit cards. Supporters argue the measure would expand transaction-routing competition, weaken the dominance of the largest payment networks, and reduce swipe fees that merchants say inflate consumer prices. The renewed momentum reflects President Trump’s recent backing of efforts to rein in credit card costs, a shift that has altered the political trajectory of legislation that has struggled to advance in prior Congresses. With Tru...
Post a Comment
Read Complete Article HERE>»

Breaking: NCUA Moves to Remove a Major Barrier to Board Service

NCUA just proposed a rule that would allow federal credit unions to reimburse or directly pay reasonable dependent care costs for volunteer officials when those costs are incurred while attending board meetings or performing official duties. Childcare and eldercare costs are real barriers to serving on a board — especially for working professionals, single parents, and caregivers. At the same time, expectations for board engagement, training, and oversight continue to rise. A few important guardrails remain: ✔️ Applies only to federal credit unions ✔️ Covers dependent care only — not lost wages or compensation ✔️ Requires written board policy and reasonable controls ✔️ IRS tax treatment still applies (talk to your CPA) Bottom line: this won't fix board recruitment challenges by itself, but it removes a real friction point for people who want to serve and simply can't absorb the added costs. NCUA is also asking for comments — including whether training and conferences...
Post a Comment
Read Complete Article HERE>»

‘No One Wants a New Car Now.’ WSJ Columnist Offers His Take on Why

NEW YORK–That new car smell isn’t quite the intoxicating perfume it has been for a long time, according to one automotive analyst. Under the headline, “No One Wants a New Car Now. Here’s Why,” the Wall Street Journal’s well-regarded automotive columnist, Dan Neal, observed that “America’s fleet of cars and trucks is also getting long in the tooth.” Neal’s reference was to a study by S&P Global Mobility that found the average age of vehicles in the U.S. is now 12.6 years, up more than 14 months since 2014, with the average age of passenger cars hitting14 years. All-Time High Burden “In the past, the average-age statistic was taken as a sign of transportation’s burden on household budgets,” Neal wrote. “Those burdens remain near all-time hig...
Post a Comment
Read Complete Article HERE>»

Advice On Winning Over Gen Z In ’25

NEW YORK—As 2025 approaches the close of Q1, how can credit unions win over Gen Z? By tailoring credit rewards for a digital-first generation, a new report recommends. Gen Z is reshaping the workforce and redefining financial behaviors. As of 2024, this generation is poised to surpass Baby Boomers in workforce size and will make up 30% of the workforce by 2030. This rapid growth presents a major opportunity for financial institutions to tap into a younger, digitally native audience with distinct spending habits and financial needs, emphasized a GlobalData report authored by Zachary Johnson, specialist, campaign execution & strategy, financial services at VDX.tv. “Unlike previous generations, Gen Z’s economic journey has been shaped by inflation and delayed career starts due to the pandemic and skyrocketing living costs. These factors have made them highly dependent on credit, with Gen Zers being 23% more likely to own a credit card than Millennials at the same age, and carrying...
Post a Comment
Read Complete Article HERE>»

'Tis the season for fraud! Teller questions if member fraud is suspected.

  When a credit union employee suspects a member may be subject to fraud, they should initiate a careful conversation focusing on the nature of the transaction and external influences. The goal is to help the member identify red flags without the employee asking for sensitive personal information that the credit union should already have on file.  Initial Verification Questions    .pdf Before discussing the specifics of the suspicious activity, the employee should confirm the member's identity in accordance with established internal protocols.  Questions About the Transaction/Activity If the member confirms they are conducting a suspicious transaction (e.g., a large wire transfer or purchase of gift cards ), the employee should ask questions to help the member pause and think critically:  "What is the purpose of this transaction?" "Do you personally know the person or business you are sending money to?" "Have you ever met the...
Post a Comment
Read Complete Article HERE>»