example.org from grabbing the cookies from
Example.org does not even have to have been compromised. A Man-In-The-Middle attacker (let's call her Mallory) could have intercepted a connection from the victim (let's call him Bob) to the benign site Bob visits over plain http. e.g.
bank.example.com. Mallory cannot manipulate traffic to
bank.example.com because this connection uses https, and all cookies are marked secure and/or HSTS is used.
bank.example.com and then monitor the network traffic. With enough traffic sent to
bank.example.com, Bob's cookie values can be determined.