Brokered Session Cookie Bank Hijack Scam

INDIA — By BharatSecure Threat Intelligence Team ·

Verdict: Suspicious | Risk Score: 8/10 | Severity: high

Category: UPI, WhatsApp, Phishing

How Brokered Session Cookie Bank Hijack Scam Works

Overview: This scam involves cybercriminals stealing and selling active browser session cookies for Indian bank accounts. These session cookies, often captured by malware, can be used to bypass two-factor authentication and log into accounts without needing OTPs. Often, attackers gain ongoing access until the victim’s session expires or is revoked. Professionals, business owners, and frequent online banking users are heavily targeted. How It Works: Criminals distribute malware through phishing links, fake updates, or rogue browser extensions. When a victim’s browser becomes infected, the session cookie from an active banking session is quietly copied and sent to the attacker. These cookies are then sold on dark web marketplaces. Buyers use them to impersonate the victim and access online banking or UPI wallets, often draining funds or collecting sensitive information. India Angle: Indian users who keep multiple netbanking tabs open, or use auto-login features, are especially vulnerable. Session cookie theft is on the rise in tech-savvy cities like Bengaluru, Hyderabad, and Pune. Most affected are business users with long desktop banking sessions. OTPs may not be triggered because the attacker uses the stolen cookie, making detection hard. Real Examples: Ramesh receives a Chrome browser update prompt via a WhatsApp forward. He installs it, not realising it’s fake. Days later, he’s alerted to unauthorised withdrawals although no OTP was received on his mobile. Red Flags: - Mystery logins you did not perform, with no OTP alert. - Messages from banks about new device registrations or suspicious activity. - Your banking app or site logs you out unexpectedly. - Browser extensions or pop-ups requesting special permissions. Protective Measures: - Never install browser extensions or updates from unofficial sources. - Log out of bank and wallet sites after use; avoid always-on sessions. - Frequently change banking passwords. - Use secure browsers with limited saved credentials. If Victimised: - Quickly contact your bank to revoke all sessions and freeze your account. - Run a full malware check on all devices. - Report the incident to the 1930 helpline and on www.cybercrime.gov.in. Related Scams: - Email Account Session Cookie Theft: Attackers use stolen email sessions to reset finance app passwords. - Remote Access Tool (RAT) Scams: Attackers take full control of your device after you download suspicious tools.

How This Scam Works — Detailed Explanation

The Brokered Session Cookie Bank Hijack Scam primarily exploits the unassuming nature of everyday users across major online platforms in India. Cybercriminals typically first find their victims through targeted ads, phishing emails, or malicious links shared on apps like WhatsApp. They may even infiltrate social media platforms, presenting themselves as tech support or financial advisors to video calls with business owners or freelancers. By using legitimate-sounding URLs, attackers can raise a sense of trust and convince users to click on a link that downloads malware onto their devices, enabling unauthorized access to their online banking information and session cookies.

Once the malware is installed, it quietly captures browsing data, including session cookies from active banking sessions. Scammers intentionally create urgent scenarios, such as alerting users to potential security breaches that require immediate action. They employ social engineering tactics like using scare tactics — “Your account will be frozen if you don’t act immediately!” to drive users into a frightful state, urging them to follow instructions that ultimately compromise their security. They may also promise exclusive benefits such as cash rewards for referrals or installation of an 'improved' banking extension, which are merely tools for further intrusion.

Victims often do not realize they have been compromised until it's too late. For instance, a business owner making frequent UPI transactions might notice unusual activity or receive a notification of a login from an unfamiliar device, yet, due to the use of session cookies, the attackers have already accessed the bank account unnoticed. Moreover, as users operate in good faith, believing they are the ones logged in, attackers can take high-value transactions without alerting the user. An alarming case in 2022 saw multiple individuals lose around ₹50 crore collectively in losses attributable to these hijacks, emphasizing the dire security awareness gap that exists among frequent online banking users.

As the effects unravel, victims find themselves in a challenging scenario where funds are siphoned away without their consent. The Reserve Bank of India (RBI) and the Ministry of Home Affairs (MHA) are increasingly looking into these scams, highlighting an uptick in financial frauds involving sophisticated hacking techniques. Reports indicate that as many as 1,500 incidents weekly were filed under cybercrimes related to session hijacking during peak pandemic months, showcasing the extensive reach of these scams across India's digital users.

To distinguish between legitimate communication from banks and this scam, keep an eye on usual patterns. Banks generally will not ask you to download software or share sensitive information through unverified channels. Unexpected logouts from banking or finance apps you're currently using, or notifications regarding unusual session activities should raise alarms. If you notice any of these red flags, change your passwords immediately and notify your bank using official helplines. Remember, common sense and caution go hand in hand when transacting online.

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does Brokered Session Cookie Bank Hijack Scam Target?

General public across India

Red Flags — How to Identify Brokered Session Cookie Bank Hijack Scam

  • Unexpected logouts from banking or finance apps.
  • Login alerts with no OTP or password required.
  • Requests to install browser extensions from unofficial sources.
  • Notifications about unfamiliar device or session activity.

What To Do If You Encounter Brokered Session Cookie Bank Hijack Scam

  1. Report any suspicious logins or transactions to your bank immediately using helplines such as SBI 1800-11-1109 or HDFC 1800-202-6161.
  2. Contact the cybercrime helpline at 1930 or visit cybercrime.gov.in to report the crime.
  3. Change your banking passwords and enable any available multi-factor authentication immediately.
  4. Scan your devices for malware using reliable antivirus software to detect and remove any threats.
  5. Inform your contacts about potential phishing attempts if you suspect you have shared sensitive information.
  6. Educate yourself about the latest scams and share information to raise awareness among family and friends.

How to Report Brokered Session Cookie Bank Hijack Scam in India

  • Call 1930 — National Cyber Crime Helpline (24x7)
  • File a complaint at cybercrime.gov.in
  • Contact your bank immediately if money was lost
  • Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What to do if I shared my OTP in a UPI scam?
Immediately contact your bank’s helpline to report the incident and request to freeze your account. Also, visit cybercrime.gov.in to report the scam.
How can I identify a Brokered Session Cookie Bank Hijack Scam?
Look out for unexpected logouts, unauthorized login notifications from your bank, or unstated requests to download extensions from unfamiliar sources.
How to report this type of scam in India?
You can report the scam by calling the cybercrime helpline at 1930 or registering a complaint at cybercrime.gov.in. Additionally, notify your bank of any fraudulent activity.
What steps can I take to recover my money or protect my account after this scam?
Contact your bank immediately to report the fraud. They may assist you in freezing your account and initiating an investigation into the transactions. Additionally, consider changing all your passwords and securing your devices.

Related Scams in India

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.