Security researchers have uncovered a significant cybercrime operation involving 93.7 billion stolen browser cookies circulating on dark web marketplaces, representing a 74% increase from the previous year’s findings.

The comprehensive analysis, conducted by NordStellar threat exposure management platform, reveals that over 15.6 billion of these stolen cookies remain active, posing immediate security risks to millions of users worldwide across 253 countries and territories.

The research identified sophisticated information-stealing malware as the primary cause behind this massive data breach.

Details of Massive Cookie Data Breach

Redline Stealer emerged as the most prolific threat, responsible for harvesting nearly 42 billion cookies, though only 6.2% remained active due to the malware’s broad but less targeted approach.

Vidar, another malware-as-a-service platform, collected approximately 10.5 billion cookies with 7.2% still valid, while the newer LummaC2 stealer accounted for over 8.8 billion stolen cookies with 6.5% remaining active.

Particularly concerning is CryptBot, which, despite collecting only 1.4 billion cookies, maintained an exceptional 83.4% active rate, making it the most effective malware in the dataset.

These malware tools operate by scanning browser cookie storage using methods like document.cookie.split(‘;’) to extract session data, then transmitting everything to command-and-control servers. The stolen data often appears on dark web forums within minutes of extraction.

The stolen cookies contain critical authentication data that bypasses traditional security measures.

Analysis revealed 18 billion cookies tagged with “ID” keywords, 1.2 billion labeled “session,” 272.9 million marked “auth,” and 61.2 million designated “login”.

These cookies enable session hijacking attacks where criminals can access user accounts without passwords or two-factor authentication by reusing valid Set-Cookie headers containing session identifiers.

Google services dominated the dataset with over 4.5 billion compromised cookies linked to Gmail, Google Drive, and other Google platforms, followed by YouTube and Microsoft, each accounting for over 1 billion cookies.

The technical sophistication extends beyond simple data theft, as modern infostealers like Rhadamanthys now incorporate AI-powered optical character recognition (OCR) to extract cryptocurrency seed phrases from images stored on infected devices.

Global Impact on All Platforms

Windows devices bear the majority of attacks, accounting for 85.9% of stolen cookies, while over 13.2 billion cookies originated from other operating systems or unknown sources.

The geographic distribution shows Brazil, India, Indonesia, and the United States among the most affected regions, with European countries like Spain recording 1.75 billion stolen cookies. The UK, despite accounting for only 800 million cookies, exhibited a concerning 8.3% active rate.

Security experts warn that these active cookies enable attackers to bypass multi-factor authentication on trusted devices, launch targeted phishing campaigns using personal information, and potentially deploy ransomware through compromised credentials.

The malware distribution methods include disguising as legitimate software downloads, utilizing Microsoft Software Installer (MSI) files for defense evasion, and leveraging pirated software as infection vectors.

Organizations and individuals are urged to implement regular cookie clearing practices, utilize endpoint detection solutions, and maintain updated security awareness training to combat this evolving threat landscape.

Try in-depth sandbox malware analysis for your SOC team. Get ANY.RUN special offer only until May 31 -> Try Here

The post 93+ Billion Stolen Users’ Cookies Flooded by Hackers on the Dark Web appeared first on Cyber Security News.