How to Take Cookies from the Cookie Monster: Genesis Market Takedown
summary
April 2023 law enforcement disruption targets Genesis Market, a browser cookie marketplace that sells full profiles — 450,000 profiles in the showroom and about 1.5 million stored overall across 225 countries, priced $6–$200 — used to replay sessions and bypass MFA for fraud and ransomware. Infection chains commonly use commodity loaders that deliver a DanaBot+malicious Chrome extension which exfiltrates cookies, proxies traffic through victims, and exposes a C2 via a Bitcoin-encoded string. Private-sector malware analysis, signatures and sample sharing spike detections and enable arrests but TOR remnants and resale persist.
AI-written summary · about
chapters (12)
- 0:00Genesis Market takedown intro
- 1:04Genesis Market origins
- 4:57MFA bypass risks
- 8:56Market showroom pricing
- 11:23Malware ecosystem details
- 14:10Chrome extension analysis
- 17:21Private sector role
- 19:50Arrests and sample sharing
- 21:21Aftermath of takedown
- 24:14Remediation advice
- 27:05Disrupting trust cycles
- 28:41Q&A
related talks
56mCookieMonstruo: Apple Flavour
47mCookie Monster — Stealing Cookies from the Browser
41mThe State Of Credential Stuffing And The Future Of Account Takeovers
28mStealing Chrome cookies without a password
45mThe evil friend in your browser
01h 00mHow I Met Your Data
40mGet Rich or Get Hunted Trying: Uncovering Large Scale Fraud Operations
52mBreaking Fraud and Bot Detection Solutions