A browser session cookie is a small token stored by a browser that lets a web service recognize a user who has already authenticated. It can keep the user signed in across page requests, so the service does not need to ask for a password each time. Unlike a password, a valid session cookie may grant access directly while it remains active.
In an attack, malware or a deceptive download may try to steal cookies from browser storage and use them to access email, cloud dashboards, or other services as the victim. The risk depends on the service’s protections, such as short session lifetimes, device checks, and reauthentication for sensitive actions. Defenders should monitor suspicious access to browser data, revoke active sessions if compromise is suspected, and rotate credentials from a clean device; changing a password alone may not invalidate stolen cookies.