Hackers Now Want Your Browser Sessions More Than Your Passwords, but You Can Stop Them
In April of 2023, the FBI took down an invite-only dark web marketplace called Genesis Market. The seizure was part of “Operation Cookie Monster,” a DOJ collaboration with law enforcement agencies across 17 countries. They discovered 80 million stolen credentials from approximately 1.5 million devices, including session cookies that let scammers log into a user’s account without even entering a password. Genesis Market may be gone, but bundles of leaked session cookies called “stealer logs” are still harvested and sold in other dark web spaces. In fact, NordVPN researchers counted more than 52.4 billion stolen cookies in infostealer data between June 2025 and 2026. That said, the good news is that stolen session cookies stop working as soon as you revoke active sessions from your account settings. As such, it's important to find out if your session cookies ended up on the dark web, remediate your account if necessary, and avoid such leaks...