Some advanced scams convince you to paste a string of code into your browser's console (claiming it's part of a password finder). This code extracts your .ROBLOSECURITY cookie, giving attackers full access to your account without needing your password at all.