Operation Cookie Monster Seized Genesis Market and Data From 1.5 Million Machines

On 4 April 2023 Genesis Market was seized in an operation led by the FBI and the Dutch National Police, coordinated across 17 countries and reported as Operation Cookie Monster. Reporting describes 119 arrests and 208 property searches.

The market offered data taken from more than 1.5 million computers, covering login details for more than 80 million accounts, with over two million people listed. What it sold was packaged as bots: browser fingerprints, cookies, saved logins and autofill data from an infected machine.

The significant part of that inventory is the cookies. A password is a claim that has to be checked; a session cookie is the receipt showing the check already happened.

Replay a valid session and the second factor is not presented, because from the service’s perspective the authentication is historic. That is why we have recorded so many incidents where multi-factor authentication was in place and irrelevant — 22-0915, 22-1101, 22-0524 all defeated the factor at the moment of use, and a stolen session skips the moment entirely.

Selling the browser fingerprint alongside the cookie is what made the market unusual. Fraud detection works substantially by noticing that a session is being used from an unfamiliar device configuration; supplying the configuration defeats that check.

This is an anti-detection product, sold as a subscription with updates as the victim’s machine changed. We have recorded infostealer output at 26-0802 as the single most common origin it can name, and this is where that output was refined into something usable by people with no technical capability of their own.

This was among the largest operations of its kind, and the corpus does not treat it as decisive. At 26-0707 a botnet was reported rebuilt within six days of seizure.

The durable value of a takedown of this shape is the 1.5 million victims whose infections became known, and the two million identities that stopped being for sale on that particular counter. Whether the counter reopened elsewhere is the question the corpus keeps asking at 26-0716b and 26-0725, and the answer has generally been yes.