I think they should do something about how to prevent the malware from getting into our funds. And do a free service that will make us secure, and our funds secure where we don't have to purchase a hardware wallet because not everyone can afford that yet. I hope they do something about this right away.

Thank you kenzawak for opening this kind of discussion. It is an eye opening.

pooya87 and aoluain thank you also for answering with web browser hacking and what should be used for security and you both have the same answer into what is most advised as a great browser.

Now, I am uninstalling my chrome. I am not really into digging about browser but this is an eye opener although it aint the target of the thread.
I believe 2FA aint that easy to be hacked. Just changing a smartphone and also reporting the change will give you a hard time, what more into hacking it.
I passed all my documents just so I could get it back and it took 2 days for me to recover it all. I believe that is how secured it is.

To be honest,  between hackers and regular users that is not even a battle. Hackers win easily.

This malware affects Mac users but don't think that because you're not using a Mac you're safe from a 2-factor authentication bypass. Using phishing links, an attacker can also bypass the authentication by using the real website but acting as some kind of intermediary between you and the website, so you are getting the real code and submitting for the hacker to be have access.

A really good attacker wanting you to click a link will most likely make you click a link. The rate of people who falls for that simple attack vector is incredibly huge.

It will be a continuous battle between, this news is really alarming and needs to be well understood, hackers are always finding ways to penetrate
and if we give them a little chance they will attack quicker than we think that we are well protected, it's best to always be updated and take things
seriously to learned more prevention regarding to this concern.

Faking the identity of the victim's machine will not make you bypass 2FA, I have 2FA setup on all my exchanges and I always asked to enter my 2FA and I never changed the computer I am using with my exchanges, also in some exchanges like Bittrex I always have to confirm by email+2FA if my Ip changed. I don't see in the article any mentioning about the way the attackers get bypass 2FA and if they are talking about the old one-time text message it still can't be done because it is only valid for one-time logging and for a limited time.

It doesn't. What this malware does is try to take advantage of the session that is already open. He tries to fool the website by saying it's just a continuation of the last login.

Hacker could not type 2fa again. Since the combination expires fast. It would take advantage of the last numbers entered or the open session.

But most serious sites ask for 2fa again depending on the ip used.

thanks for the explanation. i think i get it now. it didn't occur to me that hackers were duplicating an existing session using the stolen cookies. it's still not an easy attack to pull off since the attacker needs to spoof the IP address (and other parameters) from the original session, but it's good to be aware that this can happen. it definitely makes a strong case for requiring 2FA on withdrawals (email confirmation and TOTP) in case your session gets hijacked like this.