Today, Hackers Are More Interested in Your Browser Sessions Than Your Passwords, but You Can Prevent Them From Doing So.

In April 2023, the FBI shut down a darknet marketplace called Genesis Market, which was closed to outside users. The takeover was part of Operation Cookie Monster, conducted by the US Department of Justice in collaboration with law enforcement agencies in 17 countries. Eighty million stolen credentials from approximately 1.5 million devices were recovered, including session cookies that allowed fraudsters to log into users’ accounts without even entering a password.

Genesis Market may have closed, but packages of stolen session cookies, known as “steal logs,” are still being collected and sold elsewhere on the darknet. In fact, NordVPN researchers counted over 52.4 billion stolen cookies in their data breach data between June 2025 and 2026. However, the good news is that stolen session cookies stop working once you revoke active sessions in your account settings. Therefore, it’s important to find out if your session cookies have leaked onto the darknet, restore your account if necessary, and avoid similar leaks.

Why are browser sessions so valuable?

Every time you successfully log in to your account, the website transfers a small text file called a session cookie to your browser. This cookie contains a unique session identifier that allows the website to instantly recognize you while you’re logged in. This way, you don’t have to enter your login credentials every time you navigate to a new page or submit a new request on that website.

Session cookies typically expire within a few hours to a few weeks, after which you’re logged out and required to log in again. The catch is that if someone gains access to your session cookies, they can use your authenticated session to impersonate you.

To do this, hackers use malware called infofakers, which include well-known programs like Lumma, Vidar, StealC, Acreed, and Atomic Stealer (AMOS). They infiltrate your device through infected websites, pirated software, and fake installers. Once infiltrated, they surreptitiously spy on your activity to extract passwords, PINs, autofill data, and session cookies—all of which are stored in a file called an infofaker log, which is sent directly to the hacker.

Once a hacker gains access to these logs, they can either sell them or use them for their own purposes. Either way, once someone imports these logs into their browser, they can effectively hijack your accounts using session cookies from your device. They can even use this window to log out of your account and reset your passwords.

How Stolen Log Files Are Sold on the Dark Web

The darknet boasts a highly organized supply chain used by criminals to trade data theft logs. Russian Market has effectively replaced Genesis Market as the new go-to marketplace for cybercriminals, although a significant portion of the market has also migrated to closed Telegram channels.

According to threat analysts at DarkOwl , approximately 180,000 attacker logs were sold on Russian Market in the first half of 2025 alone. Moreover, Russian Market is a well-designed store that users can access even without Onion links or the Tor browser . This means anyone can go there and purchase numerous attacker logs to launch large-scale account takeover attempts.

Meanwhile, Flare Research estimates that this doesn’t even come close to reflecting the true scale of the threat, as 90% of stolen logs now appear in private mode on Telegram. There, automated chatbots allow scammers to purchase stolen logs, similar to Amazon, with the ability to filter by country, app, and account access level. Logs sell for between $5 and $500 each, depending on the estimated value of the target accounts.

How to check if a session cookie has been leaked

There’s no single database that tracks all stolen cookies or credentials, but there are several user-friendly ways to check if your account suspects a hack. For corporate users who can afford to spend hundreds or even thousands of dollars per month on a darknet threat monitoring subscription, there are more options, but for the average user, these are generally overkill.

The easiest way is to check all your active devices and their locations in your account settings on most websites. If you find a device or location you don’t recognize, you’ve likely been the victim of a data breach. However, keep in mind that this method isn’t always reliable if you’re using iCloud Private Relay or a VPN. Still, it’s generally recommended to periodically log out of all active sessions and log back in to invalidate unauthorized ones.

Secondly, Have I Been Pwned is a free service that monitors stolen credentials on major darknet forums and markets. It doesn’t track session cookies, but if your email address or password has been leaked, it’s a safe bet they probably have your session cookies too. You can even sign up for notifications to be alerted as soon as one of your accounts is involved in a data breach. While there aren’t many consumer-oriented darknet monitoring tools on the market that track session cookies, NordVPN’s Complete or Prime plans include a real-time hacked session monitoring service that actively scans the darknet for leaks that could affect you.

What to do if your sessions are compromised?

Now that we’ve covered detection, let’s talk about what to do if you’ve confirmed your session cookies have been stolen and become the victim of an ongoing hack. Remember that the order in which you perform the steps below is important. If you perform them incorrectly, it will give attackers every opportunity to retake your accounts after the hack is complete.

1. First, run a full antivirus scan of all your devices. Attackers won’t be able to access your session cookies unless they first infect your device. Remove any malware your antivirus detects during the scan, and then, if you have time, perform a clean installation of your operating system.

2. Reset your email passwords, enable two-factor authentication for added security, and log out of all sessions before logging back in. Your email inbox is the single entry point for most attacks, as it’s where most websites send their verification codes or “magic” links.

3. Log out of all active sessions on all accounts you suspect have been hacked. This will log out any attackers currently using the hacked account.

4. Change your passwords on all platforms in order of priority. Start with banking websites, cloud storage services, and password managers.

5. Check third-party integrations and app permissions for each compromised account. Revoke access if you don’t recognize the app or it appears suspicious. Also, be sure to change any API keys you’re currently using, as they may also have been compromised.

Reducing security risks associated with session cookies.

While there’s currently no foolproof way to secure your browser sessions, this could soon change thanks to the Device Bound Session Credentials (DBSC) initiative. This open web standard effectively locks every authorized online session with a private key protected by your computer’s security chip, preventing attackers from using session cookies to impersonate you from another device. Google has already implemented DBSC in Chrome for Windows and Google Accounts; Chrome users on macOS are also gradually gaining access to this feature.

However, despite the initiative already being publicly available, no other major online provider has yet offered native support for it at the time of writing. This means DBSC’s security benefits are limited to Google services like Gmail and Docs, Chrome for Windows, and third-party websites that offer single sign-on (SSO) options for your Google account. We may see broader adoption in the near future.

More…