Cookie theft is the stealing of session cookies, which are small browser tokens that prove a user is already authenticated. If an attacker copies a valid cookie, they may be able to reuse the session and act as the victim without knowing the password again. This is why cookie theft is treated as credential access in cyber security: the cookie can be as valuable as the login itself until it expires or is revoked.
Attackers steal cookies with infostealers, browser injectors, malicious scripts, or endpoint malware that reads browser data. In banking fraud, a stolen cookie can let an attacker enter a live session and change payment details or observe sensitive information. Defenses include short session lifetimes, reauthentication for risky actions, phishing-resistant MFA, device binding, and monitoring for unusual session reuse. Browser protections such as HttpOnly and SameSite help reduce exposure, but they do not fully protect against malware running on the endpoint.