How Hackers Try to Attack Your Browser (and How to Defend It)

When a web page is not properly configured, the session cookie the page hands you can fall into a hacker’s hands. If an attacker manages to steal that session cookie, they can impersonate your identity without you ever knowing: they log into your accounts and act as if they were you.

A session cookie is a small piece of data that the website you visit issues itself the moment you start a session, and your browser stores it in its local cookie jar, tied to that domain. It exists so the server recognises that you are already logged in and does not ask for your password again. They are usually short-lived: they expire when you log out or close the browser, although a website can also give each cookie its own expiry date.

Fixing that is the web developer’s job. But there is another part of the problem that is your job: how you browse, what you download, what you accept. In this article I walk you through the browser attacks you are genuinely exposed to every day, and the simple measures you can put in place to protect yourself.

The blind spot: the vectors that arrive through the web

When we talk about email and social engineering, you will see that the web is almost always the final destination: a watering hole, a malvertising, a phishing… nearly every dangerous link that reaches you by email or SMS points to a malicious web page that, underneath, is really attacking your browser.

And there is more: even though https was a huge step forward, it does not make you immune. Attacks can also come from the very local network you are connected to —wired or Wi-Fi— with the web page not being at fault at all.

Man in the Middle (MitM): the coffee-shop attack

Imagine you connect to the public Wi-Fi at your favourite hotel or café without checking that it is the genuine one. An attacker connected to the same network runs software that intercepts your traffic and presents you with a fake login portal that looks like the one belonging to the very hotel or café you are in. From that moment on, every time you type a username and password into any screen, they go straight into the attacker’s hands.

Technically, the hacker sits between you and the legitimate server: that is what a Man in the Middle attack is. Their goal is to spy on or tamper with the communication, and the most common technique is swapping the legitimate web certificate for a fake one. A fake certificate makes you believe you are browsing in https when, in reality, someone is standing in the middle of the connection.

For this to work, the attacker relies on your browser trusting Certificate Authorities (CAs). In Spain, for example, the Royal Mint and Stamp House (FNMT) issues legitimate company certificates. The hacker, once inside your network, presents an automatically self-signed or network-local CA certificate that your browser does not know is malicious.

How to detect it (and how to escape)

1. Watch out for the browser’s certificate warnings. When the browser shows you a “not trusted” alert and offers you the option to “continue at your own risk”, do not accept it. Close the tab and switch networks.
2. If there is no other option, change the connection. Switch to your phone’s 4G/5G as a hotspot. A MitM over a mobile network link is virtually impossible.
3. Inspect the certificate yourself. Click the padlock in the address bar, choose “View certificate”, and check the Object / CN field. If it matches the website’s name, you are fine. If you see an asterisk (*) or an unfamiliar name, stop immediately: a certificate swap is in progress.
4. Always verify https in the URL. Even when the browser shows you the padlock, if the URL starts with http:// instead of https://, you are not using it.

On mobile, the address bar may be partially hidden: swipe the screen slightly to reveal the details.

SSL stripping: when they force you off https

On public networks, the attacker does not always forge the certificate. There is another very common attack called SSL stripping: the hacker drops https from your side of the connection, but between them and the destination server (Google, PayPal, your bank) they keep using https thanks to an HTTP/HTTPS proxy. The result: you think you are in https, but the first half of the path (your browser → the attacker) runs in the clear, and the attacker sees everything.

The defence is the same: check the URL is https before you ever type a credential, and switch to a mobile emergency connection whenever the network looks suspicious.

Cryptominers: mining coins on your machine

There is an attack that looks like it is “on the decline” but is still very active: installing cryptominers in the victim’s browser after a Cross-Site Scripting (XSS) attack on a legitimate web page.

Cryptominers are small pieces of code —usually JavaScript— that, the moment you visit the page, use your CPU and your electricity bill to mine cryptocurrency without your consent. They do not steal your data or touch your disk: they simply keep mining for the attacker.

Sometimes it is not the hacker, but the website’s own developer who introduces them. Other times, the website has been hacked and the attacker has injected the code into a very popular page, knowing that thousands of visitors will effectively subsidise the mining.

Signs you are being mined

Look out for the following:

• System-wide slowdown — your machine or your connection feels sluggish.
• CPU fan at maximum, even with nothing open.
• Unusual heat from your equipment.
• Higher-than-normal power consumption.
• Unknown processes that you do not recognise in the task manager.

If you suspect a web page is running a cryptominer, you can use https://urlscan.io/ to scan it. Practical rule: do not spend time on sites with a bad reputation (piracy, adult content) — they have a long history of forced cryptomining.

Watering hole: the trusted website that has been poisoned

The watering hole attack is one of the most effective because it does not try to trick you: it simply poisons the website you visit every day. The attacker identifies a site the target visits regularly (a company, an institution, a forum), compromises it, and serves malware to every visitor.

Unlike phishing, where they try to trick you into clicking a malicious link, the watering hole exploits the trust you already have in that portal. You do not do anything wrong: you just go to your usual page.

According to a Feroot study, 96 % of hackers focus on attacking the applications on web pages. And those web apps load an average of 21 third-party scripts. Every one of those scripts is a potential entry point if it has been compromised.

Your safe-browsing checklist

With all of that in mind, here are the actions you can take right now, in about five minutes:

1. Check https in the address bar before typing any password.
2. Read the certificate warnings — an “untrusted” alert is a red flag, not a minor error.
3. Switch networks (mobile 4G/5G) whenever a public Wi-Fi feels off.
4. Watch your fan and your system temperature — unexplained heat can be cryptomining.
5. Update your browser and disable any extensions you do not use.
6. Block ads and trackers with a high-quality browser (Brave is a great starting point).
7. Never download or run files from sites you do not trust, no matter how interesting the topic.
8. Anticipate the watering hole: if a trusted site suddenly starts loading slower than usual, it may already be compromised.

The browser is the doorway through which 96 % of web attacks arrive. You cannot control what a hacker does; you can control how you browse. And that line is the difference between being a victim and being just another visitor.