Infostealers and Stolen Sessions: Why a Cookie Gets Past Two-Factor Authentication

An infostealer is a program that, in a single run, collects saved passwords, cookie files, session tokens, autofill data and crypto wallet keys from a computer, then ships the lot as one archive. The nastiest item in that haul is not the passwords but the session cookies: with them, signing in to an account needs neither a password nor a second factor. Below: why that happens, what it looks like in practice, and which part of it a VPN fundamentally does not solve.

Why a stolen cookie beats a stolen password

When you sign in and confirm the second factor, the service issues your browser a session token — an entry in a cookie meaning "this browser has already been verified". Every subsequent request carries that token and no re-verification is needed: that is the whole point, otherwise you would be asked for a code on every page.

Hence the consequence. Whoever copied the cookie file presents the service with a verification that has already been passed. The password is not needed — nobody asks for it. The second factor is not needed — you answered it yourself, several hours ago. Changing the password does not help by itself: it does not revoke issued sessions unless you press a separate button.

| What was stolen | What else the attacker needs | Does changing the password help | |---|---|---| | Password | the second factor | yes | | Password + access to SMS | nothing | yes | | Session cookie | nothing | only together with signing out of all devices |

How it gets onto the computer

The delivery methods are dull and have repeated for years:

• Cracked builds of software and games. "Activator", "repack", "crack" — the most widespread channel.
• Fake updates. A page offers to update your browser or a codec; the file is downloaded and launched by you, manually.
• Attachments and password-protected archives. The password in the body of the email is not there for protection but so the mail server's antivirus cannot inspect the archive.
• A command you are asked to paste. You are shown a "prove you are not a robot" check and asked to run a line in a console. That is an ordinary software install performed by your own hands.
• Fake applications. Including ones posing as well-known VPNs: fake VPN apps.

All of these have one thing in common: you launch the file. No zero-day is required.

Scale: what the reports say and what to believe

According to industry incident reports, stolen passwords and session cookies feature in the overwhelming majority of investigated intrusions, and infostealer logs are sold as a separate commodity — the people who use the access are not the ones who infected the machine. Specific numbers diverge several-fold between reports, because they count differently: some by records in logs, some by unique credentials, some by incidents.

What to take from this is not a figure but the mechanics. Theft of data and use of the access are separated in time and between different people. That is why weeks can pass between infection and an account problem — and the connection is not obvious.

What a VPN does not do here

Plainly and without qualification: a tunnel does not protect you from an infostealer.

It encrypts the channel between you and the server. An infostealer works on the device, where the data is already decrypted: it reads the browser's files rather than intercepting traffic. A VPN being switched on has no bearing on that whatsoever.

This is not a shortcoming of any particular service but the boundary of a class of tools. What a tunnel really covers and what it does not: does a VPN make you anonymous and what data BessyConnect keeps.

Where a VPN is genuinely relevant next to this topic is on someone else's network, where the owner of the access point sees your traffic: security on public Wi-Fi. But that is a different threat.

What to do if you suspect an infection

The order matters: if you change passwords first and clean the machine afterwards, the new passwords leave by the same route.

1. Disconnect the device from the network. Carry out the remaining steps from another, known-clean one.
2. From the clean device, terminate all sessions. Every important service has a "sign out of all devices" option in its security settings — that is what revokes stolen cookies. Without it, changing the password is pointless.
3. Change passwords. Start with email: everything else is recovered through it.
4. Reissue the second factor. Treat recovery codes saved on the infected machine as known.
5. Check your mail for unfamiliar forwarding rules. A common trick: a copy of your inbox goes to the attacker and you never see the recovery emails.
6. Reinstall the system. For stealers, "cleaning it with an antivirus" is unreliable: some persist in startup and restore themselves.
7. Check your email address against leak databases. What to do next: your passwords leaked.

What lowers the risk in advance

• Do not run pirated software on a device where you are signed into important accounts. If you really must, use a separate machine or a virtual one.
• Do not store passwords in the browser. A password manager with a master password does not hand over its database to a simple read of the profile folder.
• A hardware key or a passkey instead of a code. Phishing-resistant methods are not forwarded and cannot be read over your shoulder.
• Terminate stray sessions regularly. Every few months, "sign out of all devices" in your mail and messengers.
• Never paste commands from internet guides into a console without understanding what they do. There is no such thing as a "prove you are not a robot" check that runs in a terminal.

Frequently asked questions

Does a VPN protect against infostealers? No. A tunnel encrypts the channel, while a stealer reads already-decrypted data on your device. These are different layers, and having a VPN on has no bearing on infection.

Why didn't two-factor authentication help? Because what was stolen was a session cookie, not a password. It means "verification already passed", so the second factor is not requested again.

Is changing the password enough? Not if cookies were stolen. You need to terminate all active sessions separately — in most services that is a distinct button in the security settings.

How do I know a stealer was there? There are usually no direct signs. Indirect ones: sign-ins from unfamiliar devices in your security history, new forwarding rules in your mail, login notifications for sign-ins you did not make.

Will an antivirus help? Partly. Fresh samples evade detection and some persist in the system. With a confirmed infection, the reliable route is reinstalling the system and revoking all sessions.

Related articles

WhatsApp & Telegram Alternatives for Video Calls 2025

Best video calling messengers instead of WhatsApp & Telegram. Review of Zoom, Teams, Signal, FaceTime. Bypass blocks with BessyVPN - bessy.my More

Public Wi-Fi Security: Why You Need a VPN Traveling

How public Wi-Fi in cafés, airports and hotels puts your data at risk, and how the BessyConnect VPN (VLESS+Reality) protects your traffic on any open network. More

Does a VPN Make You Anonymous? What Still Shows

A who-sees-what table, browser fingerprinting, signed-in accounts and mobile ad identifiers. What a VPN covers and what it cannot cover. More