Why a hacker can log in as you without ever knowing your password

You type your password, approve the two-factor prompt, and you're in. But your browser doesn't ask you to do that on every click — instead the server hands your browser a session cookie, a long random token that says "this device already proved who it is." For the rest of the session, that cookie is your identity. The password and the 2FA code were just the one-time ticket to get it.

That's the weakness attackers exploit in session hijacking (also called pass-the-cookie). If malware on your machine, a malicious browser extension, or a cross-site scripting bug can read that cookie, the attacker can paste it into their own browser and be logged in as you — no password and no 2FA required, because the account already thinks that session is trusted. This is exactly how several high-profile account takeovers happened even though the victims had strong passwords and multi-factor enabled.

Defenses work by binding the cookie to more than just "whoever holds it." Marking cookies HttpOnly stops JavaScript (and thus most XSS) from reading them; Secure keeps them off unencrypted connections. Servers can tie a session to a device fingerprint or IP and force re-authentication when something changes, and can expire or revoke tokens quickly. As a user, the best moves are boringly effective: log out of sensitive accounts, keep your browser and extensions clean, and treat "stay signed in forever" as a real risk.