NordVPN researchers have documented a staggering 52.4 billion stolen browser cookie records collected by infostealer malware over a single year, highlighting how session tokens have become a primary target for cybercriminals seeking to bypass authentication controls. The study, conducted through the company's NordStellar threat intelligence platform, analyzed historical infostealer logs from dark web forums and Telegram marketplaces spanning June 9, 2025 through June 8, 2026.
The findings reveal that cookie records outnumbered passwords, payment-card details, and stolen files combined by a factor of 4.6, suggesting threat actors now prioritize session data over traditional credentials. While the vast majority of captured cookies are advertising and tracking tokens with little direct security value, the small fraction representing live authentication cookies can grant attackers immediate access to email, banking, and corporate accounts — often without triggering multi-factor authentication challenges.
What's New / Specs
- Total cookie records analyzed: 52,389,324,619 (cumulative count, not unique users or devices)
- Observation window: June 9, 2025 – June 8, 2026 (approximately one year)
- Data source: Historical infostealer logs via NordStellar platform; 9,838,326 stealer logs that recorded installed security software
- Security software prevalence: 96.3% of logs with identified security products listed Windows Defender; the remainder named commercial antivirus suites
- Cookie-to-credential ratio: Cookie records appeared 4.6× more frequently than passwords, payment cards, and files combined
- Dominant cookie category: Advertising and tracking cookies (largest share by volume)
- High-risk subset: Authentication/session cookies — a small fraction but disproportionately dangerous
- NordVPN hijacked session alert telemetry: 2,057 aggregated alert rows across 144 fingerprinted devices (May 17 – June 10, 2026); median 2 alerts per device
The research methodology relied on metadata embedded in stealer logs — including country tags and malware family identifiers — to attribute cookies to geographic regions and specific malware strains. Country-level findings were derived only from records that included location data alongside the cookie payload. Cookie categorization grouped records by keywords in the cookie name (e.g., names containing "session)). The headline figure represents cumulative cookie-record counts, not unique infections, users, or devices, and NordVPN cautions that the dataset does not constitute a complete global census of all stolen cookies during the period.
Infostealer malware operates with striking efficiency: a single execution can read every browser profile on a compromised machine without requiring administrative privileges or persistence. The resulting stealer log typically packages cookies, saved credentials, autofill data, browsing history, installed software inventories, clipboard contents, and a desktop screenshot into a ZIP archive. Delivery vectors have diversified beyond traditional phishing; researchers and industry experts cite fake recruitment exercises, trojanized software projects targeting developers, "ClickFix" attacks that manipulate the clipboard to execute terminal commands, malicious browser extensions, compromised websites, and adversary-in-the-middle phishing pages that relay legitimate logins while intercepting the resulting session cookies.
Why It Matters
The shift toward session-cookie theft fundamentally alters the account-compromise playbook. A stolen session cookie functions as a pre-authenticated token — presenting it to a server convinces the backend that the user has already completed password entry and multi-factor authentication. As Picus Security's Sila Özeren Hacioglu explained, "When you log in with a password and clear MFA, the site issues a session cookie so it stops asking who you are. If an attacker steals that cookie and replays it from their own browser, the server sees a valid, already-authenticated session — no password, no MFA prompt, no passkey challenge." This renders traditional credential rotation ineffective; changing a password does not invalidate an active session cookie, which remains usable until explicitly revoked or expired.
Google and Microsoft account cookies are especially prized because those identities serve as single-sign-on gateways to dozens of downstream services. A single compromised device can yield dozens of live sessions spanning email, banking, cloud storage, and corporate SaaS tools. Stolen cookie batches are now actively traded on criminal marketplaces, and over the past two years, session extraction has moved from a secondary benefit of credential theft to the primary objective of stealer malware, according to Flare's Adrian Cheek. The prevalence of Windows Defender in infected environments (96.3% of logs with identified AV) underscores that signature-based antivirus alone cannot guarantee protection against rapidly evolving infostealer variants that frequently mutate code, delivery methods, and behavior to evade detection.
Mitigation efforts are beginning to address the root cause. Google's Chrome 146 introduced Device Bound Session Credentials (DBSC), which cryptographically bind session cookies to a hardware-backed key inside the device's TPM or Secure Enclave. This renders a stolen cookie useless on any other machine. However, adoption requires website operators to implement support on their end, meaning broad coverage will take time. In the interim, security practitioners recommend layered defenses: prompt patching, endpoint monitoring, browser hardening, application allowlisting, short-lived sessions, continuous risk evaluation, and rapid session revocation capabilities. Users who discover their cookies have been exposed should immediately log out of all sessions on the affected account, change passwords, enable MFA, review connected devices and recovery options, clear browser cookies, and scan for malware.
Our Take
The NordVPN dataset quantifies a trend that threat intelligence teams have observed for years: the criminal economy has reorganized around session hijacking because it sidesteps the strongest authentication controls organizations have deployed. The 4.6-to-1 ratio of cookies to credentials is not merely a volume statistic — it reflects a deliberate operational shift by malware operators who have learned that a handful of live session tokens yields higher return-on-effort than millions of stale passwords. The finding that nearly all infected endpoints in the telemetry ran Windows Defender should not be read as an indictment of that product; rather, it illustrates that signature-based detection is inherently reactive against polymorphic infostealers that can be recompiled and re-obfuscated within hours.
Device-bound session credentials represent the most promising technical countermeasure, but the rollout timeline is measured in years, not months. Until DBSC or equivalent binding mechanisms achieve critical mass across identity providers and relying parties, the practical defense remains operational: assume session compromise will occur, instrument for rapid detection (as NordVPN's hijacked session alert attempts), and build incident response playbooks that prioritize session revocation over password rotation. The industry's long-standing emphasis on "strong passwords and MFA" addresses the front door while the back door — the authenticated session — remains largely unguarded.
FAQ
What exactly did NordVPN count — 52.4 billion unique stolen cookies?
The 52,389,324,619 figure represents cumulative cookie records found in infostealer logs over the one-year observation window, not unique cookies, users, devices, or infections. A single compromised device can generate thousands of cookie records across multiple browser profiles and sessions, and the same cookie may appear in multiple logs if traded or duplicated.
Can a stolen cookie really bypass multi-factor authentication?
Yes. A session cookie is issued after the user completes password entry and any MFA challenge. When an attacker replays that cookie, the server recognizes a valid, already-authenticated session and does not prompt for credentials or MFA again. This is why rotating a password does not invalidate a stolen session cookie — the session remains live until explicitly revoked or expired.
Which cookies are actually dangerous?
Authentication and session cookies — those that maintain logged-in state for email, banking, corporate SaaS, and identity-provider accounts (e.g., Google, Microsoft) — pose the greatest risk. Advertising and tracking cookies, which constituted the largest share by volume in the dataset, are commercially worthless for account takeover.
Does having antivirus (including Windows Defender) protect against cookie theft?
Antivirus can detect and remove many infostealer strains, but it is not airtight. The NordVPN telemetry showed 96.3% of logs with identified security software listed Windows Defender, indicating that infostealers regularly succeed on protected endpoints. Experts recommend treating AV as one layer alongside patching, endpoint monitoring, browser controls, application allowlisting, and safer user behavior.
What is Device Bound Session Credentials and when will it help?
DBSC, introduced in Chrome 146, cryptographically binds a session cookie to a hardware-backed key in the device's TPM or Secure Enclave. A stolen cookie becomes unusable on any other machine. However, websites must adopt DBSC on their end, so widespread protection will take time as identity providers and relying parties implement support.
