Do note, however, that it seems to take a half hour to decrypt the PayPal cookie in their demonstration. That’s probably more than enough time for you to have completed your transaction and logged out. The article doesn’t specify, but it seems this is only an attack to be able to see what you are doing, not steal credentials.