NordVPN study finds 52.4 billion cookies stolen globally

A research project by the cybersecurity firm NordVPN identified 52.4 billion cookies taken by infostealer malware over a single year. Session cookies were the most frequently stolen data type, appearing 4.6 times more often than all other categories combined, and enable attackers to hijack active user sessions without passwords.

Three malware families – Lumma‑C2, RedLine and Vidar – were responsible for almost 80 % of the thefts. The stolen cookies originated from more than 250 countries, with India leading the volume (4.68 billion), followed by Brazil (2.83 billion), the United States (2.43 billion), Indonesia (2.10 billion) and the Philippines (1.93 billion). Per‑capita, Uruguay, Peru and Chile showed the highest concentration.

The most common platforms targeted were Google (11.78 million records), Facebook (8.10 million) and Microsoft (7.85 million), while entertainment and streaming services such as Twitch, Netflix, YouTube, Reddit and Bing also appeared frequently. NordVPN’s CTO Marijus Briedis said, “We are seeing a radical change in how hackers operate. It is no longer about forcing a password but stealing the digital key already inserted into the lock.”