Hackers Now Want Your Browser Sessions More Than Your Passwords, but You Can Stop Them

In April of 2023, the FBI took down an invite-only dark web marketplace called Genesis Market. The seizure was part of “Operation Cookie Monster,” a DOJ collaboration with law enforcement agencies across 17 countries. They discovered 80 million stolen credentials from approximately 1.5 million devices, including session cookies that let scammers log into a user’s account without even entering a password. 

Genesis Market may be gone, but bundles of leaked session cookies called “stealer logs” are still harvested and sold in other dark web spaces. In fact, NordVPN researchers counted more than 52.4 billion stolen cookies in infostealer data between June 2025 and 2026. That said, the good news is that stolen session cookies stop working as soon as you revoke active sessions from your account settings. As such, it’s important to find out if your session cookies ended up on the dark web, remediate your account if necessary, and avoid such leaks in the first place.

What makes browser sessions so valuable?

Every time you successfully log into an account, the website hands your browser a small text file called a session cookie. Inside the text file is a unique session ID that lets the website instantly recognize you for as long as you’re logged in. That way, you don’t have to keep entering your login credentials every time you navigate to a new page or make a fresh request on that website. 

Session cookies typically come with an expiration period that ranges from a few hours to several weeks, at the end of which you’re logged out and have to re-enter your credentials again. But the catch is, if someone else gets their hands on your session cookies, they can piggyback off of that logged-in session by pretending to be you. 

To accomplish this, hackers use a type of malware called infostealers, which includes infamous names like Lumma, Vidar, StealC, Acreed, and Atomic Stealer (AMOS). They make their way onto your device through infected websites, pirated software, and fake installers. Once in, they quietly spy on your activities to extract passwords, PINs, autofill data, and session cookies—all of which goes into a file called a stealer log that’s delivered straight to the hacker. 

Once a hacker has access to these stealer logs, they can either sell them or use them for themselves. Either way, as soon as someone imports those logs into their browser, they can effectively take over your logged-in accounts using those session cookies from your device. They can even use that window to log you out and reset your passwords. 

How stealer logs get sold on the dark web

There’s a very organized dark web supply chain that attackers use to trade in stealer logs. Russian Market has effectively replaced Genesis Market as the new storefront for black hat cybercriminals, although much of the market has also shifted to private channels on Telegram.

According to threat analysts at DarkOwl, approximately 180,000 stealer logs were sold on Russian Market in just the first half of 2025. What’s more, Russian Market is a well-designed storefront that users can access even without Onion links or the Tor browser. That means anyone could go there and buy a bunch of stealer logs to start attempting account takeovers at scale. 

Meanwhile, Flare Research estimates that this isn’t even close to the actual scale of the threat, because 90% of stealer logs now surface privately on Telegram. There, automated chatbots let scammers shop for stealer logs like it’s Amazon, with options to filter by country, app, and account privilege. Logs sell for anywhere between $5 and $500 a piece, depending on the estimated value of the target accounts. 

How to check if your session cookies have leaked

There isn’t one single database that keeps track of every stolen cookie or credential, but there are a few consumer-friendly ways to check if you’re feeling suspicious that your account has been compromised. More options exist for enterprise users who can afford to spend hundreds or even thousands of dollars a month in subscriptions to keep track of dark web threats, but those are mostly overkill for regular users. 

The easiest way to go about this is to take a look through all your active devices and their locations in your account settings on most websites. If you see a device or location you don’t recognize, you are likely the subject of an ongoing breach. However, keep in mind that this may not always be a reliable method if you use iCloud Private Relay or a VPN. Still, it’s generally best practice to log out of all active sessions every once in a while and perform a fresh login to invalidate any unauthorized sessions.

Secondly, Have I Been Pwned is a free service that tracks stolen credentials across major dark web forums and markets. It doesn’t actually track session cookies, but if your email address or password ended up in a breach, it’s safe to say that they probably have your session cookies too. You can even sign up for notifications so you get alerted the moment one of your accounts shows up in a data leak. While there aren’t many consumer-focused dark web monitoring tools that track session cookies, NordVPN’s Complete or Prime plans include a real-time monitoring service for hijacked sessions that actively scans the dark web for leaks that might affect you. 

What to do if your sessions are compromised

Now that we’ve covered detection, let’s talk about what to do when you’ve confirmed that your session cookies are stolen and you’re the victim of an ongoing breach. Remember, the order in which you follow the steps below matters. If you do them in the wrong sequence, that’ll give attackers all the opportunity they need to take over your accounts again after you’re done.

1. Begin by running a full antivirus scan on any devices you own. Attackers can’t get their hands on your session cookies unless they infect your device first. Remove any malware that your antivirus flags during the scan, then do a clean install of your operating system if you can spare the time. 

2. Reset the passwords on your email account, enable two-factor authentication for added protection, and sign out of all sessions before doing a fresh login. Your email inbox is the single point of entry for most attacks because that’s where most websites send their verification codes or magic links. 

3. Sign out of all active sessions on every account that you suspect is compromised. This will log out any attackers who are currently on a hijacked browsing session. 

4. Change your passwords on every platform in order of priority. Start with banking websites, cloud storage providers, and password managers first. 

5. Look through each compromised account’s third-party integrations and app permissions. Revoke access if you can’t recognize an app, or it looks suspicious. Also make sure to rotate any API keys that you’re currently using, since those may have been compromised as well. 

Reducing security risk from session cookies

While there’s no foolproof way to keep your browser sessions safe for now, that might soon change with the Device Bound Session Credentials (DBSC) initiative. This is an open-web standard that will effectively lock each logged-in online session with a private key protected by your computer’s security chip, so that attackers can’t use session cookies to impersonate you from a different device. Google has already implemented DBSC on Chrome for Windows and Google accounts; Chrome users on macOS are also getting access to this feature gradually. 

But while the initiative has already been open-sourced, no other major online provider has begun offering native support for it as of this article. That means DBSC’s security benefits are limited to Google services like Gmail and Docs, Chrome for Windows, and third-party websites that offer single sign-on (SSO) options for your Google account. We might see a wider rollout in the near future, though.