FixableProtecting your accounts
Session hijacking & cookie theft
Stealing the “already signed in” token to skip your password.
Understand it
When you sign in, your device holds a session cookie that says “this person is logged in”. Take that cookie and an attacker is you - no password or two-step required.
How to spot it
Being signed out unexpectedly, or account activity from places you have never been.
Close the gap
- Sign out of sensitive accounts rather than leaving them open indefinitely.
- Keep devices clear of infostealers.
- Use “sign out of all sessions” after any scare.
- On your own site, bind sessions tightly and expire them sensibly.
What to do about it
This is part of your plan - Switch on updates and lock your devices. Work through it there and you’ll close this off along with everything else it covers.