How the Cookie Crumbles: What OSINT Tells Us About Dark Web Cookie Sales
summary
OSINT research shows stolen cookies sold on dark web consistently available and used to bypass MFA, with the EA compromise cited as a concrete example where purchased cookies opened Slack access. Demonstrations use the automated proxy tool Evilginx to capture session tokens, and malware families sometimes include cookie-theft modules. Tracking across Tor marketplaces and directories yields repeatable evidence over months, so defenders prioritize phishing filters, conditional access, network monitoring and migration to FIDO2 authentication.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 1:30OSINT and ethics
- 5:51HTTP cookies explained
- 8:46Cookie theft risks
- 12:24Evilginx demo
- 15:02Dark web basics
- 18:14Legal considerations
- 20:01Dark web cookie sales
- 24:21Marketplaces and forums
- 27:40Searching dark web
- 29:14Future trends
- 30:17GDPR impact
- 31:43Summary
- 33:57OSINT defense tips
- 36:26Q&A
related talks
28mCookie Crumbles: Unveiling Web Session Integrity Vulnerabilities
40mGet Rich or Get Hunted Trying: Uncovering Large Scale Fraud Operations
21mDeath to Cookies
47mCookie Monster — Stealing Cookies from the Browser
40mNavigating the Shadows: A Comprehensive Exploration of Popular and Malicious Tools on the Dark Web
56mCookieMonstruo: Apple Flavour
26mTechnical Tracks
41mThe State Of Credential Stuffing And The Future Of Account Takeovers