Wiktionary
caught with one's hand in the cookie jar
a. (context idiomatic English) observed or apprehended while committing a theft, especially while embezzle money. alt. (context idiomatic English) observed or apprehended while committing a theft, especially while embezzle money.