How do hackers steal a Google account or any other cookie by actually copying the victims cookie?

A user's session cookie is essentially their credential after they've been authenticated and until they are signed off. Its the token that each HTTP request needs to present to the server so that it knows the 'context' of the request.

Hence, if you obtain the session cookie of a logged in user, you can essentially impersonate him/her without actually knowing their password. A very common method to steal cookies are our beloved XSS attacks. However, a good combination of CSP settings and protections like XSS auditor combined with httpOnly cookies thwarts most XSS attacks. If you find one on gmail, you'll probably get a hefty sum of $$ via their bug bounty program ;)

CSRF is another way how attackers make servers perform changes that weren't authorized or initiated by the user. There was a cute CSRF attack on gmail where a attacker could send POST requests to create an email filter on user's account which will essentially forward a copy all emails to an email of attackers choice. Read about it at: https://www.wired.com/2007/09/gmail_flaw_lets_anyone_read_your_e-mail/

Obviously there are bunch of other attacks that can be leveraged to compromise user's account or data in some way or the other.

How do hackers steal a Google account or any other cookie by actually copying the victims cookie?

This is how cookies work in general:

A user's session cookie acts as their credential after they've been authenticated and until they are signed off. A user provides valid username/password and gets a session cookie in return. Its this cookie that each subsequent HTTP request needs to present to the server so that it knows the 'context' of the request. This ensures that a user isn't asked for the username/password for each page/request.

Hence, if you obtain the session cookie of a logged in user, you can essentially impersonate him/her without actually knowing their password. A very common method to steal cookies are our beloved XSS attacks. However, a good combination of CSP settings and protections like XSS auditor combined with httpOnly cookies thwart most XSS attacks. If you find one on gmail, you'll probably get a hefty sum of $$ via their bug bounty program ;)

CSRF is another way how attackers make servers perform changes that weren't authorized or initiated by the user. There was a cute CSRF attack on gmail where a attacker could send POST requests to create an email filter on user's account which will essentially forward a copy all emails to an email of attackers choice. Read about it at: https://www.wired.com/2007/09/gmail_flaw_lets_anyone_read_your_e-mail/

Obviously there are bunch of other attacks that can be leveraged to compromise user's account or data in some way or the other.