Short answer
When you sign in, the site stores a session cookie in your browser so you don’t have to log in again. Cookie-stealing (infostealer) malware copies those cookies and sends them to the attacker, who can then open your account without your password or 2FA code — Google notes that cookie theft happens after login, so it bypasses two-factor authentication. The fix is an order: clean the infected device first, then from a clean device change passwords, sign out of every session, and check recovery details, forwarding rules and connected apps.
How the attack works
- You run a file disguised as something useful — a “sponsorship” brief, a game cheat, cracked software, a fake PDF reader or a browser extension.
- The malware reads the browser’s saved passwords and session cookies and uploads them within seconds.
- The attacker loads the cookies into their own browser and is already signed in: no password prompt, no code.
- They change the email, phone and 2FA, or use the account quietly. Google’s Threat Analysis Group reported YouTube channels hijacked this way being sold or used to broadcast cryptocurrency scams.
Warning signs
- A sign-in alert or a session you don’t recognise — though often there is no alert at all, because the attacker reuses a session you already opened.
- Changes you didn’t make: channel name, recovery email, linked devices, ad spend, posts or messages.
- Several accounts going wrong at the same time — a sign that the passwords and cookies came from one infected computer.
- You recently installed software, a mod or an extension from outside an official store, or opened an archive sent by a “brand”.
Clean up in this order
Changing passwords on the infected computer doesn’t help: the malware can capture the new ones too.
- Stop logging in on the infected device. Scan it with up-to-date security software and remove unknown extensions — or reset it if you can.
- From a clean device, secure the email account first: new password, sign out of other sessions, check the recovery phone and email.
- Change the passwords of the other affected accounts and sign out everywhere: Google Account → Security → Your devices; Microsoft → Sign out everywhere; Accounts Centre → Where you’re logged in.
- Remove what the attacker may have left behind: forwarding rules and filters, connected apps, new 2FA methods and recovery details.
- Turn on a passkey or app-based 2FA and save new backup codes.
Why two-factor authentication didn’t stop it
2FA checks you at the moment you sign in. A stolen cookie is proof that the sign-in already happened, so the site has no reason to ask again. That is why Google is building Device Bound Session Credentials, which tie a session to the device that created it so a copied cookie is far less useful elsewhere. Until such protections are everywhere, the best defence is simple: don’t run files you didn’t ask for, and review your sessions regularly — see how to check logged-in devices.
If you can’t get back in
If the attacker has already changed the email and phone number, use the platform’s own recovery route: official recovery links, hacked YouTube channel or hacked Google account. Our hacked account recovery service works only through those official channels.
Frequently asked questions
Can someone get into my account without my password or 2FA code?
Yes. If malware steals the session cookie from your browser, the attacker can reuse a session you already opened — no password or code is asked for until that session ends.
Does changing my password log the hacker out?
On most platforms it ends other sessions, but do it from a clean device and also use “sign out everywhere”. On an infected computer, the new password can be stolen again.
How do I know if my computer has cookie-stealing malware?
Typical signs are several accounts compromised at once after installing cracked software, game cheats or unknown extensions. Scan with up-to-date security software; if in doubt, reset the device.
Will a passkey stop cookie theft?
A passkey stops phishing of the login itself, but a cookie stolen after login can still be abused. Combine passkeys with clean devices and signing out of sessions you don’t use.
Sources: Google Threat Analysis Group — cookie theft malware targeting YouTube creators, Google — fighting cookie theft using device bound sessions, Google Account Help — see devices with account access, Microsoft Support — sign out of your Microsoft account everywhere, YouTube Help — clean up a hacked channel