Skip to main content

Warning: Hackers could take over your email account by stealing cookies, even if you have multi-factor authentication (MFA)

 



Posted: November 5, 2024 by Pieter Arntz

The Federal Bureau of Investigation (FBI) has issued a warning that cybercriminals are taking over email accounts via stolen session cookies, allowing them to bypass the multi-factor authentication (MFA) a user has set up.

Here’s how it works.

Most of us don’t think twice about checking the “Remember me” box when we log in. When you log in and the server has verified your authentication—straight away or after using MFA–the server creates a session and generates a unique session ID. This session ID is stored in a session cookie (or a “Remember-Me cookie” as the FBI calls it) on your browser, which is typically valid for 30 days.

Every time you return to that website within the time frame, you don’t need to log in. That’s really convenient… unless someone manages to steal that cookie from your system.

If someone steals the session cookie, they can log in as you—even if you have MFA enabled.

This is particularly relevant for email handlers that have an online—webmail—component. This includes major players like Gmail, Outlook, Yahoo, and AOL.

With access to your email account, a cybercriminal can find a lot of useful information about you, such as where you bank, your account numbers, your favorite shops, and more. This information could then be used for targeted cyberattacks that only mention information relevant to you, leaving you more likely to fall for them.

Cybercriminals could use your account to spread spam and phishing emails to your contacts. And perhaps most worrying of all, once an attacker is in your email account they can reset your passwords to your other accounts and login as you there too.

How do these criminals get their hands on your session cookies? There are several ways.

On very rare occasions, session cookies can be stolen by you visiting a malicious website, or via a Machine-in-the-Middle (MitM) attack where a cybercriminal can intercept traffic and steal cookies if they’re not protected by HTTPS on an unsecured network.

However, session cookies are usually stolen by malware on the your device. Modern information-stealing malware is capable of, and even focuses on, stealing session cookies as part of its activity.  

How to keep your email account safe

There are a few things you can do to stay safe from the cookie thieves:

  • Use security software on every device you use.
  • Keep your devices and the software on them up to date, so there aren’t any known vulnerabilities on them.
  • Decide whether you think it’s worth using the Remember me option. Is convenience worth the risk in this situation?
  • Delete cookies, or—even better—log out when you are done. That should also remove or invalidate the session ID from the server, so nobody can use it to log in, even if they have the session cookie.
  • Only visit sites with a secure connection (HTTPS) to protect your data from being intercepted during transmission.
  • For important accounts regularly check the log in history where you can see which devices logged in when and from where. You should be able to find this option in your account settings.

Comments

Post a Comment

Please no profanity or political comments.

Popular posts from this blog

Effective January 1, 2026 - Credit Union Succession Planning

  First Responder Credit Union Academy www. NCOFCU .org   Effective January 1, 2026 This  statement  from current NCUA Chairman Todd M. Harper states that “this final rule on succession planning establishes a way for the NCUA to address one of the most common causes for unplanned and unforced credit union mergers. It also ensures that smaller institutions remain the cornerstone of ...
Post a Comment
Read Complete Article HERE>»

Federal Reserve Committee decided to lower the target range for the federal funds rate by 1/4 percentage point to 3-1/2 to 3‑3/4 percent

  Federal Reserve issues FOMC statement For release at 2:00 p.m. EST Share Available indicators suggest that economic activity has been expanding at a moderate pace. Job gains have slowed this year, and the unemployment rate has edged up through September. More recent indicators are consistent with these developments. Inflation has moved up since earlier in the year and remains somewhat elevated. The Committee seeks to achieve maximum employment and inflation at the rate of 2 percent over the longer run. Uncertainty about the economic outlook remains elevated. The Committee is attentive to the risks to both sides of its dual mandate and judges that downside risks to employment rose in recent months. In support of its goals and in light of the shift in the balance of risks, the Committee decided to lower the target range for the federal funds rate by 1/4 percentage point to 3-1/2 to 3‑3/4 percent. In considering the extent and timing of additional adjustments to the target range for...
Post a Comment
Read Complete Article HERE>»

Credit Union Profits Climb 21% As Margins Widen, NCUA Reports

  If you don't read anything else, read this:  Performance By Asset Category WASHINGTON—Federally insured credit unions posted a sharp rebound in profitability through the third quarter of 2025, with net income up 21% year over year to an annualized $19.1 billion, according to new NCUA data. The increase—one of the strongest gains across the agency’s quarterly metrics—came as institutions benefited from rising interest income, wider net interest margins, and relatively stable credit costs. The NCUA reported that Q3 data show interest income climbed 7.6% over the period while the systemwide net interest margin expanded nearly 13%, helping credit unions absorb higher operating expenses and modest increases in loan-loss provisioning. The earnings surge outpaced the credit union system’s 3.7% asset growth and came amid a mixed lending environment in which residential mortgage balances rose sharply, but auto lending weakened. The industry’s aggregate net worth ratio also im...
Post a Comment
Read Complete Article HERE>»

Fed’s Powell: Strong hiring could force further rate hikes

By CHRISTOPHER RUGABER WASHINGTON (AP) — Federal Reserve Chair Jerome Powell said Tuesday that if the U.S. job market further strengthens in the coming months or inflation readings accelerate, the Fed might have to raise its benchmark interest rate higher than it now projects. Powell’s remarks followed the government’s blockbuster report last week that employers added 517,000 jobs in January , nearly double December’s gain. The unemployment rate fell to its lowest level in 53 years, 3.4%. “The reality is if we continue to get strong labor market reports or higher inflation reports, it might be the case that we have to raise rates more” than is now expected, Powell said in remarks to the Economic Club of Washington. Though price pressures are easing and Powell said he envisions a “significant” decline in inflation this year, he cautioned that so far the central bank is seeing only “the very early stages of disinflation. It has a long way to go.” Even as the Fed has raised r...
Post a Comment
Read Complete Article HERE>»

Sunday Reading - Lake Manly Returns

  Lake Manly Returns   An ancient lake has  reemerged in California's Death Valley National Park following record rainfall this year.  Between 128,000 and 186,000 years ago, meltwater from ice covering the Sierra Nevada fed rivers that emptied into Badwater Basin, North America’s lowest point at 282 feet below sea level. The steady flow sustained Lake Manly, nearly 100 miles long and roughly 600 feet deep. The lake disappeared as Death Valley evolved into the driest place in North America , with some areas receiving under two inches of rain annually. This year, however, the park received 2.41 inches between September and November, marking its wettest autumn on record and triggering the temporary return of a shorter, shallower Lake Manly.  Above-average rainfall periodically brings Lake Manly back, including in 2023 when Hurricane Hilary dumped 2.2 inches of rain on a single August day, allowing visi...
Post a Comment
Read Complete Article HERE>»

Sunday Reading - What happened at Pearl Harbor?

    What happened at Pearl Harbor? On Dec. 7, 1941, Japan launched a surprise attack on the American naval base at Pearl Harbor, Hawaii ( watch visualization ). The strike marked the culmination of a decade of rising tensions as Japan expanded its empire   across East Asia and the Pacific. With its industrial capacity unable to match the United States in a long-term war, Japanese leaders opted for a preemptive blow designed to cripple American naval power.   The attack—which permanently sank three American ships, damaged 15 more, and killed 2,403 Americans—was a tactical success but a strategic failure. Japanese forces did not hit the base’s oil reserves, submarine facilities, or repair yards, all of which proved crucial in the months that followed. The US Navy ultimately refloated all but three damaged ships, returning many to combat . Pearl Harbor was the deadliest attack on US ...
Post a Comment
Read Complete Article HERE>»

Fed to Keep Rates Higher Even Longer; CU Economists Still See Chance for Cuts Soon

CU trade economists think another good inflation report or two might convince the Fed to lower rates twice this year. By Jim DuPlessis | June 12, 2024 at 04:11 PM Fed Chair Jerome Powell speaks at a news conference in Washington, D.C., Wednesday afternoon. The Fed kicked the can down the road Wednesday, keeping rates at their current high level and signaling that it will take more time in reducing them. The Federal Open Market Committee (FOMC) ended its two-day meeting Wednesday with a decision to maintain the federal funds rate at 5.25% to 5.50%. Its projection report showed half of FOMC members expect the rate to fall to 5.1% by year's end, indicating one 25-basis-point rate cut this year. In March, the median expectation was for two rate cuts. Fed Chair Jerome Powell said half of members expect rates will fall to 3.1% by end of 2026. The FOMC's four remaining meetings this year are July 30-31, Sept. 17-18, N...
Post a Comment
Read Complete Article HERE>»

Sheehans Consulting LLC - "We only have one goal in mind!"

We have one goal in mind: “What is best for you? We achieve strategic initiatives, develop products, optimize profitability and productivity through best practices, and make our firm a strong asset for professional services.  With over 30 years of experience in public administration, credit union, and association management, I have developed a solid track record in leadership and development.  Please visit us at https://www.sheehansconsultingllc.com/ to learn more about what we can do for you.   _________________________________________ Check out some of NCOFCU's additional features: First Responder Credit Union Academy Financial Literacy Podcasts YouTube Mini's Blog Job Board
Post a Comment
Read Complete Article HERE>»

NCUA promises flexibility in examinations and the flexibility to prudently adjust or alter member loan terms

In an effort to help members through the coronavirus crisis, the NCUA will give credit unions the flexibility to prudently adjust or alter member loan terms and will not subject those decisions to “examiner criticism,” agency Chairman Rodney Hood said Monday. Hood, in a letter to credit unions , outlined the steps the agency is taking to address the health emergency. Those steps include requiring all agency staff to work offsite through March 30. All examination work will be conducted offsite as well, the agency said. “A credit union’s efforts to work with members in communities under stress may contribute to the strength and recovery of these communities,” Hood wrote in outlining steps that credit unions may take to help members. Those steps include: Waiving ATM fees and increasing ATM daily cash withdrawal limits. Waiving overdraft fees. Waiving early withdrawal penalties in time deposits. Easing restrictions on cashing out-of-state and non-members checks. Easing credit terms f...
Post a Comment
Read Complete Article HERE>»

NCUA"s new video module provides best practices for merging

The three-part video module provided by NCUA, available online   here , examines current trends in mergers, when a credit union board should consider a merger and how to negotiate a merger agreement that best serves the credit union’s interests. Every credit union should discuss the possibilities of a future merger in their strategic planning.
Post a Comment
Read Complete Article HERE>»