Judy created a forum. One day, she discovers that a user is posting strange images without writing comments. She immediately calls a security expert, who discovers that the following code is hidden…

The hidden code behind the image is a classic XSS-based session hijacking payload. When a user clicks the image, the malicious script silently executes in the browser context, accessing document.cookie or session identifiers and exfiltrating them to an attacker-controlled server without the victim's knowledge, allowing the attacker to impersonate the user.

While some XSS payloads can redirect users, the scenario specifically describes code hidden behind images designed to steal session data, not perform a redirect, and no window.location or redirect logic is indicated.

The attack is focused on reading and stealing existing session cookies rather than injecting new cookies into the browser; cookie injection is a different attack vector not described here.

This is not a virus targeting usernames and passwords directly; it is a session hijacking attack that steals active session tokens, which is technically distinct from credential harvesting malware or keyloggers.