Commodity malware steals authenticated sessions, letting thieves freeload on victims' paid usage