South Africa features prominently in new research from cybersecurity company NordVPN, which has identified more than 52.4-billion stolen cookies in historical infostealer data over a single year. Browser cookies have become the primary currency for cybercriminals, appearing 4.6 times more often than all other stolen data types combined — including passwords, files, and payment cards.
Stolen cookies allow attackers to bypass login screens entirely. By reusing an active session cookie, a criminal can impersonate a logged-in user without ever needing their password, a technique known as session hijacking.
“We are seeing a fundamental shift in how hackers operate. It is no longer just about cracking a password. It’s about stealing the digital key that is already turned in the lock,” says Marijus Briedis, chief technology officer at NordVPN.
Your everyday accounts are the target
The most frequently stolen records were not tied to banking logins, but to widely used everyday platforms. Google topped the dataset with 11.78-million stolen records, followed by Facebook (8.10-million) and Microsoft (7.85-million).
Separate insights from NordVPN’s hijacked session alert data suggest that session-cookie exposure also affects entertainment and social platforms heavily. Services such as Twitch, Netflix, YouTube, Reddit, and Bing appeared frequently among detected exposures, showing that accounts used for browsing, streaming, and leisure are also valuable to attackers.
Cookie theft knows no borders
Cookie theft was recorded across more than 250 countries and territories. India led the dataset with 4.68 billion stolen cookies, followed by Brazil (2.83B), the United States (2.43B), Indonesia (2.10B), and the Philippines (1.93B). When adjusted for population size, Uruguay, Peru, and Chile showed the highest concentration of stolen cookies per person.
South Africa ranks 30th globally, with over 263-million cookies found in the analysed datasets.
Because more than 96% of the analysed infection logs came from devices with active security software, the study emphasizes that traditional protection must be paired with rapid response. Marijus Briedis recommends logging out of sessions, clearing browser caches, and using session-monitoring tools to invalidate stolen digital keys before they can be exploited.
“Cookie theft is a reminder that cybersecurity is not just about prevention. It is also about how quickly you act when something goes wrong. If a session cookie is stolen, logging out of affected accounts and refreshing that session can significantly limit the damage,” says Briedis.
Methodology: NordVPN researchers analysed historical infostealer cookie data available through the NordStellar platform over a one-year period from 9 June 2025 to 8 June 2026. Figures reflect cumulative cookie-record counts, not unique users, devices, accounts, or infections. The findings also include limited internal insights from NordVPN’s hijacked session alert data collected between February and June 2026.