Netflix accounts taken over in South Africa through session cookie hijacking
“These cookies allow users to stay logged in to websites or to save items in a shopping cart even after they exit a site. Through these cookies, cybercriminals have found an exploit that has allowed them to access protected private accounts. They are specifically taking advantage of “remember-me cookies”, which help users log in to different websites and platforms on the Internet without having to re-enter their details.”
This was a big thing about two years ago and safeguards were built into Chrome (and Chromium) browsers but that really worked when the hosting service implemented those Device Bound Session Credentials (DBSC) protections. Seemingly Netflix has not done this. It seems that many entertainment and media platforms still rely on standard long-lived bearer cookies.
Some good practices though for end users are:
* Log Out explicitly: Closing a tab leaves the session token alive in local storage. Click Log Out on accounts when finished, which sends a revoke request to the server and invalidates the token.
* Use "Sign out of all devices": If you suspect malware or a compromised browser, use the account dashboard (e.g., Netflix's "Manage Access and Devices" or Google's "Security -> Your Devices") to invalidate all current session keys instantly.
* Passkeys: Where supported, switch from traditional passwords + long-lived sessions to Passkeys (FIDO2/WebAuthn). Passkey sign-ins rely on public-key cryptography bound to your device's hardware enclave (TPM or security key), making token replication significantly harder for off-device attackers.
* Unknown links: Don't click on them is this is often how the session cookies are stolen.
See
https://mybroadband.co.za/news/security/661065-netflix-accounts-taken-over-in-south-africa.html#technology #southafrica #security
