Suzanne Kantra/Techlicious generated by ChatGPT
A hacker doesn't need your password to get into your Netflix account, your Gmail, or plenty of other logins. All they need is a session cookie, the small file a website stores on your device to remember that you're already signed in. Steal the right one and an attacker can load it into their own browser, fooling a site into thinking the hacker is you, no password required.
Security researchers call that session hijacking, and according to new NordVPN research, it's driving a surge in cookie theft: cybercriminals collected more than 52.4 billion stolen browser cookies over the past year, making cookies the single most common type of data lifted by infostealer malware, software built to siphon passwords, files, and login data off an infected device. "We are seeing a fundamental shift in how hackers operate," said NordVPN chief technology officer Marijus Briedis. "It is no longer just about cracking a password. It's about stealing the digital key that is already turned in the lock."
NordVPN's researchers pulled the figures from infostealer logs analyzed through the company's NordStellar platform between June 9, 2025, and June 8, 2026. Alongside the 52.4 billion cookies, the dataset of stolen information included more than 6 billion autofill entries, 2 billion files, 1 billion credential records, 607 million passwords, 341 million victim email addresses, and 1.09 million payment cards. Stolen cookies outnumbered those other categories combined by more than 4.6 to 1.
Advertising and tracking cookies made up the largest share of what got stolen. Fortunately, those can't be used to unlock a login. But stacked together, it hands an attacker a fairly accurate sketch of who you are and what you do online – useful material for a more convincing phishing email or a fake customer service call.
The malware doing the stealing is concentrated in a small number of tools. Three infostealer families, Lumma-C2, RedLine, and Vidar, accounted for nearly four out of every five stolen cookies in the dataset. The tools are cheap, widely available, and don't require much skill to deploy. People typically pick them up through unsafe downloads, fake software updates, malicious ads, cracked apps, game cheats, or infected email attachments.
The stolen-login records NordVPN reviewed skewed toward everyday consumer accounts rather than corporate or banking logins. Google's login page, accounts.google.com, appeared most often with 11.78 million records, followed by Facebook at 8.10 million and Microsoft's login.live.com at 7.85 million. Instagram, Discord, Netflix, and Roblox also placed in the top ten. And a single compromised login rarely stays contained: it can expose saved payment methods, private messages, linked accounts, and password reuse across other services you signed up for with the same email.
NordVPN traced stolen cookies to more than 250 countries and territories. By raw volume, India led with 4.68 billion, followed by Brazil at 2.83 billion, the United States at 2.43 billion, Indonesia at 2.10 billion, and the Philippines at 1.93 billion.
Disturbingly, the research showed that antivirus software is not enough on its own to prevent these attacks. Among roughly 9.8 million stealer logs that recorded which security software was installed on the infected device, 96.3% named Windows Defender. Most of these infections started because someone was tricked into running a malicious file, a process that can be difficult for antivirus scanners to prevent. An antimalware security suite is still worth running, but user diligence plays a key part in effective prevention.
The rest of your defense is taking threats seriously and reacting quickly. If you find get a notification from your security software that a session cookie or login turned up in a stolen-data set, log out of the account everywhere, since logging out invalidates the cookie an attacker would otherwise reuse. From there, change the password, turn on two-factor authentication if you haven't already, and check the account's recent activity, connected devices, recovery options, and saved payment methods for anything unfamiliar. Finally, clear the cookies stored in your browser and run a malware deep scan on all of your devices, since an infostealer that's still active on a device will just keep finding new cookies to steal.
"Cookie theft is a reminder that cybersecurity is not just about prevention," Briedis said. "It is also about how quickly you act when something goes wrong. If a session cookie is stolen, logging out of affected accounts and refreshing that session can significantly limit the damage."
Read more: The best VPNs for protecting your privacy
