Skip to main content

Warning: Hackers could take over your email account by stealing cookies, even if you have multi-factor authentication (MFA)

 



Posted: November 5, 2024 by Pieter Arntz

The Federal Bureau of Investigation (FBI) has issued a warning that cybercriminals are taking over email accounts via stolen session cookies, allowing them to bypass the multi-factor authentication (MFA) a user has set up.

Here’s how it works.

Most of us don’t think twice about checking the “Remember me” box when we log in. When you log in and the server has verified your authentication—straight away or after using MFA–the server creates a session and generates a unique session ID. This session ID is stored in a session cookie (or a “Remember-Me cookie” as the FBI calls it) on your browser, which is typically valid for 30 days.

Every time you return to that website within the time frame, you don’t need to log in. That’s really convenient… unless someone manages to steal that cookie from your system.

If someone steals the session cookie, they can log in as you—even if you have MFA enabled.

This is particularly relevant for email handlers that have an online—webmail—component. This includes major players like Gmail, Outlook, Yahoo, and AOL.

With access to your email account, a cybercriminal can find a lot of useful information about you, such as where you bank, your account numbers, your favorite shops, and more. This information could then be used for targeted cyberattacks that only mention information relevant to you, leaving you more likely to fall for them.

Cybercriminals could use your account to spread spam and phishing emails to your contacts. And perhaps most worrying of all, once an attacker is in your email account they can reset your passwords to your other accounts and login as you there too.

How do these criminals get their hands on your session cookies? There are several ways.

On very rare occasions, session cookies can be stolen by you visiting a malicious website, or via a Machine-in-the-Middle (MitM) attack where a cybercriminal can intercept traffic and steal cookies if they’re not protected by HTTPS on an unsecured network.

However, session cookies are usually stolen by malware on the your device. Modern information-stealing malware is capable of, and even focuses on, stealing session cookies as part of its activity.  

How to keep your email account safe

There are a few things you can do to stay safe from the cookie thieves:

  • Use security software on every device you use.
  • Keep your devices and the software on them up to date, so there aren’t any known vulnerabilities on them.
  • Decide whether you think it’s worth using the Remember me option. Is convenience worth the risk in this situation?
  • Delete cookies, or—even better—log out when you are done. That should also remove or invalidate the session ID from the server, so nobody can use it to log in, even if they have the session cookie.
  • Only visit sites with a secure connection (HTTPS) to protect your data from being intercepted during transmission.
  • For important accounts regularly check the log in history where you can see which devices logged in when and from where. You should be able to find this option in your account settings.

Comments

Post a Comment

Please no profanity or political comments.

Popular posts from this blog

Why Auto Lending Is Starting To Stand Out As A Real Threat To CUs

  By Ray Birch MILWAUKEE—Auto lending is emerging as one of the biggest areas of risk for credit unions, even as the broader U.S. economy continues to perform better than many expected, according to Bill Handel, chief economist at Raddon, a Fiserv company. Delinquency trends in auto portfolios are now approaching levels last seen during the Great Financial Crisis, Handel said, driven by a combination of high vehicle prices, elevated interest rates and increasing financial pressure on lower-income consumers. “There’s probably still a lot of risk in the auto portfolios,” Handel said. “Our numbers in terms of delinquency behavior in the United States are now rivaling what they were during the Great Financial Crisis.” Economy Holding Up Better Than Expected Despite those pockets of risk, Handel said the broader economy remains surprisingly resilient. “If you look at the U.S. economy, it’s actually performing quite well—probably better than most people would have anticipated,” he said. ...
Post a Comment
Read Complete Article HERE>»

When Cooperation Turns To Competition: A Turning Point For The Firefighter Credit Union Movement

  By Grant Sheehan For decades, firefighter credit unions have stood as a model of what cooperative finance is meant to be—institutions built not to compete ruthlessly, but to serve a shared mission: supporting the financial well-being of those who risk their lives in service to others. That’s what makes the recent actions of Firefighter First Credit Union so concerning. Firefighter First FCU was not just another participant; it was a founding member of the National Council of Firefighter Credit Unions (NCOFCU). It helped shape the very principles of collaboration, mutual respect, and non-encroachment that have long defined our community. Those principles weren’t accidental; they were intentional safeguards to ensure that firefighter-focused credit unions could grow together, not at each other’s expense. But something has changed. Firefighter First FCU’s decision to pursue a nationwide charter marks a clear shift in direction—from cooperation to direct competition. This isn’t simpl...
Post a Comment
Read Complete Article HERE>»

Small Credit Unions Don’t Lack Representation—They Lack Board Education

  By Grant Sheehan Let’s be clear— representation  for small credit unions is not something new that suddenly needs to be invented. For more than 150 years in Europe and 115 years in the U.S., many of us—along with numerous trade groups representing postal workers, schools, hospitals, the military, first responders, electricians, welders, auto workers, and many other sponsor employee groups—have been actively representing and supporting small credit unions. The mission has always been the same: protect these institutions and ensure they have a voice. The real challenge facing small credit unions has never been a lack of organizations claiming to represent them. The challenge has been engagement and education. Many small credit unions operate with extremely limited resources. Their boards are made up of volunteers who already have full-time careers. Even when scholarships, training opportunities, and conferences are offered, the realities of travel costs, staffing shortages, op...
Post a Comment
Read Complete Article HERE>»

With Graham Signaling New Budget Bill, Credit Unions Brace For Tax Debate

By Ray Birch WASHINGTON— Senate Budget Committee Chairman Lindsey Graham’s comments Wednesday that Republicans will “expeditiously move toward creating a second budget reconciliation bill” are giving new shape to what had been a speculative discussion in Washington—and prompting renewed attention within the credit union industry to whether the movement’s federal tax exemption could again surface as lawmakers look for possible offsets. In a post on X, Graham said that after consulting with President Trump, his team and Senate Majority Leader John Thune, the Senate Budget Committee will move quickly on a second reconciliation package focused on “adequate funding to secure our homeland” and support for the military. The remarks are notable because they offer one of the clearest indications yet that a second fast-track budget measure—previously discussed but far from certain—may now be gaining traction. CUToday.info on Wednesday reached out to House Budget Committee Chairman Jodey Arringto...
Post a Comment
Read Complete Article HERE>»

The United States at 250: How the Country Has Changed in the Past 50 Years

  In July, the United States will celebrate its 250th anniversary. The country’s last major milestone was 50 years ago, at its bicentennial on July 4, 1976. U.S. society has changed profoundly since then. Over the past five decades, the U.S. population has  aged significantly,  with the percentage of people 65 and older nearly doubling. The country has also become  more racially and ethnically diverse,  as growing shares of people identify as Asian or Hispanic. And following more than 70 million immigrant arrivals, the percentage of  foreign-born people  in the population has more than tripled.  Americans are also  less likely to be married  than ever before. Women – who now have far more options outside of the home than they did in 1976 – have contributed to a  boom in higher education  and helped  expand the workforce.  And even though many Americans are financially better off than they were 50 years ago,  econ...
Post a Comment
Read Complete Article HERE>»

Honoring Our Member Credit Unions Ranked Among the Top 100 in 2025

Celebrating Excellence: Honoring Our Member Credit Unions Ranked Among the Top 100 in 2025   Best-performing US credit unions of 2025 At NCOFCU, we take immense pride in the strength, resilience, and impact of our member credit unions. Today, we are thrilled to recognize and celebrate several of our members who have earned a place among the Top 100 Best Performing Credit Unions of 2025 —a testament to their unwavering commitment to service, financial stewardship, and community leadership. This achievement is not just about rankings—it reflects the daily dedication to members, the trust built within communities, and the innovation that continues to drive our movement forward. 🌟 Our Honored Members We proudly congratulate the following institutions for their outstanding performance: #7 – Long Beach Firemen's Credit Union A remarkable top-10 finish that highlights exceptional operational excellence and member value. Long Beach Firemen’s CU continues to set a high bar for perform...
Post a Comment
Read Complete Article HERE>»

Credit Unions Look For Answers After NCUA Shake-Up

FAQ on Recent Firing of NCUA Board Members ,   click here. WASHINGTON—Do Todd Harper and Tanya Otsuka have legal standing to contest their removal from the NCUA board by President Donald Trump? Has any past president taken similar action? Can NCUA continue functioning without a quorum on its board? Is this the first step toward consolidating federal banking regulators? In light of President Trump’s decision to remove Democratic NCUA board members Harper and Otsuka, many in the credit union community have expressed concerns and raised important questions. In response, America’s Credit Unions has prepared a detailed Q&A document addressing the implications of the White House’s actions announced on Wednesday. Below are key takeaways from the document ACU has shared with its members: President Trump may now nominate either one or two new board members to fill these vacant positions. At least one must be from a different political party, as statutorily required by the FCU Act. Or, l...
Post a Comment
Read Complete Article HERE>»

Agencies Issue Exemption Order To Customer Identification Program (CIP) Requirements

WASHINGTON--The Federal Deposit Insurance Corporation, the Office of Comptroller of the Currency, and NCUA, with the concurrence of the Financial Crimes Enforcement Network, issued an order Friday granting an exemption from a requirement of the Customer Identification Program (CIP) Rule implementing Section 326 of the USA PATRIOT Act. The CIP Rule requires a bank or credit union to obtain taxpayer identification number (TIN) information from its customer before opening an account, and the exemption permits a bank or credit union to use an alternative collection method to obtain TIN information from a third-party rather than from the customer, the agencies stated in a joint release. The order applies to accounts at all entities supervised by the agencies. "Since the CIP Rule was issued initially in 2003, there has been a significant evolution in the ways consumers access financial services, along with a rise in reported customer reluctance to provide their full TIN due, in part, to...
Post a Comment
Read Complete Article HERE>»

IWS Acquisition Corporation Is 2015 Official Conference Sponsor of National Coalition of Firefighter Credit Unions Annual Meeting

  CONTACT: Margaret Blankers MJB Public Relations Group 866.714.7041 · margaret@mjbpr.com IWS Acquisition Corporation Is 2015 Official Conference Sponsor of National Coalition of Firefighter Credit Unions Annual Meeting Boca Raton, FL. (June 4, 2015) – IWS Acquisition Corporation (IWS) is pleased to announce it is the Official Conference Sponsor for The National Coalition of Firefighter Credit Unions (NCOFCU) 2015 Annual Conference. The Conference, “By Firefighters for Firefighters, will be held in Nashville Oct. 7-10. NCOFCU is the nation’s premier professional association of credit unions serving firefighters and their families. “We are thrilled to welcome IWS as this year’s Official Conference Sponsor,” said Grant J. Sheehan, Executive Director & CEO of NCOFCU. “I have firsthand experience with IWS’ dedication and commitment to our brotherhood of credit unions. For five years, we have been pleased to partner with and endorse IWS’ suite of vehicle protection products...
Post a Comment
Read Complete Article HERE>»