Andy Norton, risk officer EMEA at endpoint protection company SentinelOne, said: "Yahoo said in its announcement that an ongoing forensic investigation suspects that the attacker had access to proprietary code to learn how to forge cookies.