It steals cookies and website data (like the Độ Mixi incident). This form has become too common. Once it has these, it can log in on another device without needing a password, OTP code...

HACK!
I just got my Binance account hacked!
Yesterday, I unknowingly clicked on some malware that deleted the Binance app on my laptop.
I logged out of my Google account on the browser and the inbox where I enter the code to log into my Google account was reported back to the machine.
I entered it, and 5 minutes later, the account was completely cleared.
Everyone, be careful. So sad.