Warning: Hackers could take over your email account by stealing cookies, even if you have MFA

The FBI warns that cybercriminals are taking over webmail accounts by stealing session cookies to bypass MFA, enabling access to sensitive information, spreading spam/phishing, and resetting passwords across other services. The advisory explains how session cookies work, highlights info-stealing malware as the primary theft vector, and recommends mitigations such as using security software, keeping systems updated, avoiding persistent “Remember me” sessions, logging out to invalidate sessions, using HTTPS, and monitoring account login history.