Table of contents
- The invisible threat in our browsers
- Why cookies are so tempting to hackers
- Web giants under attack
- Malware is constantly evolving
- How to really defend yourself from cookie theft
- The size of the phenomenon
The invisible threat in our browsers
Nearly 94 billion computer cookies have ended up on the dark web, according to a survey conducted by NordVPN via the NordStellar platform.
A frightening number, up 74% compared to 2024. And behind this data there is much more than a digital nuisance: stolen cookies can open the doors of our personal accounts to cybercriminals looking for easy money.
Of the 253 countries monitored, Italy is in 20th place with over 1.2 billion compromised cookies, of which 94 million are still active.
Why cookies are so tempting to hackers
Cookies are small files used by websites to track our online activities: login sessions, preferences, virtual shopping carts, even banking data.
They are designed to make our lives easier, but in the hands of cybercriminals they turn into digital keys that open our accounts without even needing a password.
“Cookies seem harmless, but in the wrong hands they are extremely dangerous,” warns cyber security expert Adrianus Warmenhoven.
Web giants under attack
It is not surprising that the most used platforms are the main victims:
- Google : 4.5 billion cookies stolen
- YouTube : 1.33 billion
- Microsoft and Bing : Over 1 Billion Each
18 billion assigned IDs and 1.2 billion session IDs were identified: critical elements that allow access to personal accounts.
Malware is constantly evolving
The theft of cookies is not accidental. There are at least 38 different malware behind it, tripled compared to the 12 detected in 2024. The most active?
- RedLine : 41.6 billion cookies stolen
- Vidar : 10 billion
- LummaC2 : 9 billion
26 new malware types emerged in 2025, including RisePro, Stealc, Nexus, and Rhadamanthys.
How to really defend yourself from cookie theft
Digital hygiene is the first defense:
- cookies and browsing history regularly
- Use strong and different passwords for each service
- Always enable two-factor authentication (2FA)
- Update your devices regularly
- Don’t click on suspicious links or offers that seem too good to be true.
“Closing the browser is not enough,” Warmenhoven explains, “cookies remain active. Only manually deleting them makes them unusable for hackers.”
The size of the phenomenon
The research was based on the analysis of Telegram channels used for the sale of stolen data. No transactions were made, but the analysis of 93.76 billion cookies allowed to:
- Identify the active and inactive
- Mapping the malware used
- Detect the geographical origin of data
Questions and answers
- What are computer cookies?
They are small text files saved by the browser that memorize the user’s activities on a site. - Why are cookies stolen?
They allow hackers to access personal accounts without passwords. - How are cookies stolen?
Through malware installed on users’ devices. - What is RedLine?
An infostealer malware that steals cookies, passwords, and autofill data. - How do I know if I’ve been infected?
Check sites like HaveIBeenPwned and monitor for suspicious logins. - Are cookies always dangerous?
No, but if not managed correctly they can be a risk. - What does a session ID do?
It keeps your login session active on a site. If stolen, it allows unauthorized access. - Can I avoid cookies altogether?
Not altogether. Some are essential, but you can limit or delete them regularly. - What is two-factor authentication?
A system that requires two proofs of identity to access an account (e.g. password + SMS). - What software protects against cookie theft?
Up-to-date antivirus, browser extensions like uBlock Origin, and password managers with alerts.
