Infostealer Session Hijacking: How Malware Steals Google Master Cookies & Bypasses Two-Factor Authentication (2FA)

The Modern Threat Vector: You Never Shared Your Password, Yet You Were Hacked

Many victims of Google account hijacking swear that they never clicked a phishing link, never entered their password on a fake login page, and had strong hardware 2FA enabled.

*How could an attacker compromise the account without the password or the 2FA token?*

The answer is Session Hijacking via Infostealer Malware.

Malware strains such as LummaC2, RedLine Stealer, Vidar, and Stealc do not waste time prompting you for passwords. Instead, they infect your machine via cracked software, malicious Discord attachments, fake PDF invoices, or Trojanized game mods, and target your browser’s local Session Token Storage.

How Infostealers Extract Google Master Session Cookies

When you log into Google on Chrome, Edge, or Brave and check "Remember me", Google issues a set of cryptographically signed HTTP cookies: - `__Secure-1PSID` & `__Secure-3PSID`: Primary session authentication tokens. - `HSID` & `SSID`: Session security hashes. - OAuth Refresh Tokens: Long-lived tokens stored in Chromium’s local database.

Chromium browsers store these cookies inside an encrypted SQLite database: `text %LocalAppData%\Google\Chrome\User Data\Default\Network\Cookies `

Under Windows, Chromium encrypts cookie values using the Windows Data Protection API (DPAPI), with the master key stored in Local State.

The Attack Execution: 1. The infostealer executes in the user context and queries the Windows DPAPI to decrypt the Chromium master key: CryptUnprotectData(). 2. It parses the Cookies SQLite file, decrypts every single session cookie for google.com, and compresses them into a ZIP archive along with system hardware specs. 3. The archive is exfiltrated to the cybercriminal’s Command-and-Control (C2) server via encrypted Telegram webhooks or Tor. 4. The attacker imports these cookies into an anti-detect browser (such as AdsPower or Dolphin Anty). 5. The attacker opens Google: Because the session cookies are 100% valid, Google treats the attacker as already logged in, requiring zero password and zero 2FA prompt!

Emergency Remediation: Severing Stolen Master Sessions

If your machine has been compromised by an infostealer: 1. Immediately Isolate the Infected Workstation: Unplug Ethernet and disable Wi-Fi. Running anti-virus while the machine is online allows the attacker to maintain real-time access. 2. Invalidate Master OAuth Sessions Globally: From an uninfected secondary device (e.g., an iPhone or clean laptop), log into your Google Account -> Security -> Your Devices -> Click Sign out of all unknown devices. 3. Change Master Password Immediately: Changing your Google password triggers a global session revocation, instantly invalidating stolen __Secure-PSID cookies on the attacker's browser. 4. Revoke Third-Party Apps & OAuth Tokens: Check myaccount.google.com/permissions and delete all unauthorized applications.

For enterprise accounts compromised by malware, contact our [Google Incident Recovery Team](/services/hacked-gmail-google-recovery) or review our [Instagram & Social Account Recovery Desk](/services/instagram-account-recovery).