They Did Not Need Your Password. They Needed the Session You Already Opened.

You did everything right. Long password, two-factor on, nothing reused. Then an account gets taken over anyway, with no failed login attempt and no code sent to your phone.

Google explains why in one sentence: cookie theft happens after login, so it bypasses two-factor authentication. The attacker did not break the door. They copied the fact that you had already walked through it.

Sponsored by Behind the Markets

$725 billion committed. Five gigawatts building.

Dear Friend,

Not long ago the line to plug into the Texas grid held 63 gigawatts.

Within a year it hit 226.

By April it reached 410.

Texas has never used more than 85 gigawatts on the hottest day in its history.

The queue is nearly five times the record. About 87% of it is data centers.

The four largest technology companies came into this year planning to spend $650 billion on AI infrastructure. Three months later they raised it to $725 billion.

The money is real. The concrete is not.

Of the 12 to 16 gigawatts of new capacity planned in America this year, roughly 5 are actually under construction.

Every stock you own in this boom sits on one side of a single question.

Does it pay the toll, or own the toll booth?

Dylan Jovine found the company holding the gate. He is giving away the name, free.

See which side of the tollgate you're on >>

"The Buck Stops Here,"

Kelly Maguire

Behind the Markets

Look Behind the Curtain

When you log in, the site hands your browser a session token, stored as a cookie. That token is what keeps you logged in, and presenting it is as good as presenting your password and your second factor together. It is the receipt, and the site does not ask again.

Information-stealing malware exists to take exactly that. Microsoft's analysis of one such family describes it extracting saved passwords, session cookies and autofill data from every mainstream browser, along with crypto wallets and messaging apps; Microsoft counted more than 394,000 infected Windows machines in a two-month window in 2025 from that family alone. The Justice Department, announcing action against two others in 2024, put it bluntly: these tools bypass multi-factor authentication through the theft of authentication cookies.

Then comes the detail that changes the response. Google again: stolen cookies continue to work even after the malware has been detected and removed. Running a scan and declaring the problem solved leaves the thief logged in.

How it gets onto an ordinary household machine is not exotic. Cracked software is one route. Search advertising is another, and the FBI warned about it years ago: criminals buy ads impersonating real brands so the fake download sits above the real one. The fastest-growing route has a name, ClickFix, and it is worth recognizing because it requires the victim to do something very specific. A page shows what looks like a CAPTCHA or a browser error and tells you to verify yourself: press the Windows key and R, press control and V, press enter. The page has silently put a command on your clipboard. On a Mac the same lure asks you to paste into Terminal and then enter your password.

Nobody legitimate has ever asked you to do that. There is no verification step on the internet that involves typing into the Run box.

The Capability Multiplier

The advantage is that the recovery sequence has a correct order, and most people run it backwards.

Changing your password first, on an infected machine, hands the new password straight to the thief. Changing it without revoking sessions leaves the stolen cookie working regardless, because the cookie never needed the password. The order that works is: clean the machine, then sign out everywhere, then change passwords from a device you trust.

That middle step is the one almost nobody knows exists. Every major service has a control that ends all active sessions, usually labeled sign out of all devices or manage active sessions. It is the only action that invalidates a stolen token. The FTC's malware guidance says to stop logging into anything sensitive until the device is cleared; the sign-out-everywhere step you have to know about yourself.

The second piece of leverage is recognizing the one instruction. Every ClickFix variant ends with you pasting something you cannot read into a command prompt. A household rule that nobody ever types into the Run box or Terminal because a website asked covers the entire technique, including versions nobody has invented yet.

There is help arriving at the browser level. Chrome began rolling out device-bound session credentials on Windows this year, which ties a session to the machine's security chip so an exfiltrated cookie is useless elsewhere. It is not everywhere yet, and it does not help on a machine that is already compromised, but it is the first structural fix in a long time.

The Sovereign Action

Learn the order before you need it.

• Never paste a command into the Windows Run box or a Mac Terminal because a web page told you to. No real verification works that way.
• Download software from the vendor's own site, typed in directly. The top search result may be a paid ad impersonating the brand, and an ad blocker is the FBI's own suggestion.
• If a machine is suspect, clean it first. Changing passwords on an infected device just updates the thief's records.
• Then sign out of all sessions everywhere, not just change the password. That is the only step that kills a stolen cookie.
• Keep the browser updated and prefer one supporting device-bound sessions. It limits what a stolen cookie is worth.

We encourage all readers to consult a qualified financial professional — such as a registered investment adviser or licensed broker — before making any investment decision.