You install an extension to block ads or take screenshots. It looks clean, does its job, and stays quietly in the toolbar. But behind the scenes, it may copy your session cookies, track your activity, and maybe even watch what you type. Session Cookies Session cookies are tiny tokens that keep you logged in. Steal them, and wow the attacker can act as you . No 2FA. No email alerts. No suspicions. That’s why attackers are pushing fake browser extensions designed to grab these