A type of attack called session hijacking, often fueled by malware stealing browser "cookies' or "tokens," is becoming increasingly common. It allows attackers to take over your logged-in accounts without ever needing your password.