Netflix accounts taken over in South Africa through session cookie hijacking

“These cookies allow users to stay logged in to websites or to save items in a shopping cart even after they exit a site. Through these cookies, cybercriminals have found an exploit that has allowed them to access protected private accounts. They are specifically taking advantage of “remember-me cookies”, which help users log in to different websites and platforms on the Internet without having to re-enter their details.” This was a big thing about two years ago and safeguards were built into Chrome (and Chromium) browsers but that really worked when the hosting service implemented those Device Bound Session Credentials (DBSC) protections. Seemingly Netflix has not done this. It seems that many entertainment and media platforms still rely on standard long-lived bearer cookies. Some good practices though for end users are: Log Out explicitly: Closing a tab leaves the session token alive in local storage. Click Log Out on accounts when finished, which sends a revoke request to the…