How long they will last depends on a few factors.

In April of 2023, the FBI took down an invite-only dark web marketplace called Genesis Market. The seizure was part of “Operation Cookie Monster,” a DOJ collaboration with law enforcement agencies across 17 countries. They discovered 80 million stolen credentials from approximately 1.5 million devices, including session cookies that let scammers log into a user’s account without even entering a password. 

Genesis Market may be gone, but bundles of leaked session cookies called “stealer logs” are still harvested and sold in other dark web spaces. In fact, NordVPN researchers counted more than 52.4 billion stolen cookies in infostealer data between June 2025 and 2026. That said, the good news is that stolen session cookies stop working as soon as you revoke active sessions from your account settings. As such, it’s important to find out if your session cookies ended up on the dark web, remediate your account if necessary, and avoid such leaks in the first place.

What makes browser sessions so valuable?

Every time you successfully log into an account, the website hands your browser a small text file called a session cookie. Inside the text file is a unique session ID that lets the website instantly recognize you for as long as you’re logged in. That way, you don’t have to keep entering your login credentials every time you navigate to a new page or make a fresh request on that website. 

Session cookies typically come with an expiration period that ranges from a few hours to several weeks, at the end of which you’re logged out and have to re-enter your credentials again. But the catch is, if someone else gets their hands on your session cookies, they can piggyback off of that logged-in session by pretending to be you. 

To accomplish this, hackers use a type of malware called infostealers, which includes infamous names like Lumma, Vidar, StealC, Acreed, and Atomic Stealer (AMOS). They make their way onto your device through infected websites, pirated software, and fake installers. Once in, they quietly spy on your activities to extract passwords, PINs, autofill data, and session cookies—all of which goes into a file called a stealer log that’s delivered straight to the hacker. 

Once a hacker has access to these stealer logs, they can either sell them or use them for themselves. Either way, as soon as someone imports those logs into their browser, they can effectively take over your logged-in accounts using those session cookies from your device. They can even use that window to log you out and reset your passwords. 

How stealer logs get sold on the dark web

There’s a very organized dark web supply chain that attackers use to trade in stealer logs. Russian Market has effectively replaced Genesis Market as the new storefront for black hat cybercriminals, although much of the market has also shifted to private channels on Telegram.

According to threat analysts at DarkOwl, approximately 180,000 stealer logs were sold on Russian Market in just the first half of 2025. What’s more, Russian Market is a well-designed storefront that users can access even without Onion links or the Tor browser. That means anyone could go there and buy a bunch of stealer logs to start attempting account takeovers at scale. 

Meanwhile, Flare Research estimates that this isn’t even close to the actual scale of the threat, because 90% of stealer logs now surface privately on Telegram. There, automated chatbots let scammers shop for stealer logs like it’s Amazon, with options to filter by country, app, and account privilege. Logs sell for anywhere between $5 and $500 a piece, depending on the estimated value of the target accounts. 

How to check if your session cookies have leaked

There isn’t one single database that keeps track of every stolen cookie or credential, but there are a few consumer-friendly ways to check if you’re feeling suspicious that your account has been compromised. More options exist for enterprise users who can afford to spend hundreds or even thousands of dollars a month in subscriptions to keep track of dark web threats, but those are mostly overkill for regular users. 

The easiest way to go about this is to take a look through all your active devices and their locations in your account settings on most websites. If you see a device or location you don’t recognize, you are likely the subject of an ongoing breach. However, keep in mind that this may not always be a reliable method if you use iCloud Private Relay or a VPN. Still, it’s generally best practice to log out of all active sessions every once in a while and perform a fresh login to invalidate any unauthorized sessions.

Secondly, Have I Been Pwned is a free service that tracks stolen credentials across major dark web forums and markets. It doesn’t actually track session cookies, but if your email address or password ended up in a breach, it’s safe to say that they probably have your session cookies too. You can even sign up for notifications so you get alerted the moment one of your accounts shows up in a data leak. While there aren’t many consumer-focused dark web monitoring tools that track session cookies, NordVPN’s Complete or Prime plans include a real-time monitoring service for hijacked sessions that actively scans the dark web for leaks that might affect you. 

What to do if your sessions are compromised

Now that we’ve covered detection, let’s talk about what to do when you’ve confirmed that your session cookies are stolen and you’re the victim of an ongoing breach. Remember, the order in which you follow the steps below matters. If you do them in the wrong sequence, that’ll give attackers all the opportunity they need to take over your accounts again after you’re done.

1. Begin by running a full antivirus scan on any devices you own. Attackers can’t get their hands on your session cookies unless they infect your device first. Remove any malware that your antivirus flags during the scan, then do a clean install of your operating system if you can spare the time. 

2. Reset the passwords on your email account, enable two-factor authentication for added protection, and sign out of all sessions before doing a fresh login. Your email inbox is the single point of entry for most attacks because that’s where most websites send their verification codes or magic links. 

3. Sign out of all active sessions on every account that you suspect is compromised. This will log out any attackers who are currently on a hijacked browsing session. 

4. Change your passwords on every platform in order of priority. Start with banking websites, cloud storage providers, and password managers first. 

5. Look through each compromised account’s third-party integrations and app permissions. Revoke access if you can’t recognize an app, or it looks suspicious. Also make sure to rotate any API keys that you’re currently using, since those may have been compromised as well. 

Reducing security risk from session cookies

While there’s no foolproof way to keep your browser sessions safe for now, that might soon change with the Device Bound Session Credentials (DBSC) initiative. This is an open-web standard that will effectively lock each logged-in online session with a private key protected by your computer’s security chip, so that attackers can’t use session cookies to impersonate you from a different device. Google has already implemented DBSC on Chrome for Windows and Google accounts; Chrome users on macOS are also getting access to this feature gradually. 

But while the initiative has already been open-sourced, no other major online provider has begun offering native support for it as of this article. That means DBSC’s security benefits are limited to Google services like Gmail and Docs, Chrome for Windows, and third-party websites that offer single sign-on (SSO) options for your Google account. We might see a wider rollout in the near future, though. 

You’ll be able to access Visual Intelligence from a new tab in the tablet’s Camera app.

Seagate doesn’t think hybrid drives are done just yet. On Tuesday, the company announced the launch of the new FireCuda Forge line of storage drives. The new drives combine the high capacity of a traditional plattered HDD with the speed and responsiveness of a user-supplied solid-state drive (SSD). The new hybrid storage solution is Seagate’s first to be powered and managed by the new Alkemi intelligent storage platform.

The FireCuda Forge is available right now through Seagate’s web store, and comes in 8TB ($699) or 20TB ($899) HDD configurations—neither of which includes the required SSD. Users will have to bring their own SSD, with some specific restrictions. The FireCuda Forge is compatible with M.2 2280 NVMe drives that are PCIe Gen3 or higher. The maximum supported NVMe capacity is 1TB, which means that’s as much data as you’ll be able to dedicate to storage on the “fast side” of the hybrid setup. The NVMe will require minimum speeds of 2,400MB/s read and 2,000MB/s write, and a unit with DRAM cache is recommended. Seagate claims 2,500MB/s read and 2,000MB/s write speeds for the combined system, along with USB4 and support for Windows 11 and macOS 26+.

Credit:
Seagate

Read full article

Comments

Google Fi is bringing back network switching through an unnamed “secondary” 5G carrier. “Most users will be on the ‘Primary network,’ but Google Fi will automatically switch users to the ‘Secondary network’ if it meaningfully improves performance with so-called ‘smart thresholds’ for doing so,” reports 9to5Google. “At launch, there is no manual switching.” When Project Fi first launched the service included support with both Sprint and T-Mobile. That went away when T-Mobile acquired Sprint in 2020. 9to5Google reports: Google is not naming the second network today, but did share that Ultra Wideband is supported. Officially, you are switching between “two of America’s fastest 5G networks.”

Fi Wireless does note that users have top priority, so data is never deprioritized on the Primary network. Meanwhile, there’s “highest QCI priority” on the backup network that means subscribers are among the last to be slowed down when there’s congestion. This is also available internationally when local partner networks are available with the Flexible and Unlimited Premium plans.

Network switching will first be supported on Pixel 9 and newer devices that have a Google Fi eSIM (and no other SIM active). It makes use of Android’s Multiple Enabled Profiles (MEP) eSIM technology that allows for two carrier profiles on a single chip. […] These Google Fi updates start rolling out today, with network switching seeing gradual availability.

Read more of this story at Slashdot.

There are many reasons why someone might use a VPN, but most often, it’s to conceal your real geographic location or prevent websites from tracking your online activity. It can also be a way to get around location-based restrictions that stop you from accessing certain websites or platforms. 

When you connect to a VPN server in the United States, websites are supposed to detect that your online traffic is originating from the U.S. That way, you can access online platforms that use IP filters to block non-U.S. traffic or circumvent regional censorship when travelling outside the U.S. But if you connect to a VPN server in the United States while you’re vacationing in Mexico, and a website thinks your IP address is from Brazil, that might not solve your problem and may even add unnecessary complications. 

If you’ve encountered something similar with your VPN provider, there are several fixes you can try. Depending on why your IP location is being misinterpreted, one of these should help you access the internet from the server location of your choice. 

Why websites misread your VPN location

IP geolocation isn’t infallible. Websites rely on third-party IP databases to look up your location based on your current IP address. Maxmind, which has one of the largest such databases in existence, claims that its GeoIP products have a 99.8% accuracy. Lesser-known providers with smaller IP databases may be far less accurate. 

Websites can also use more than just your IP address to estimate your location. For example, they can send WebRTC requests to your browser or directly query your device’s GPS. Moreover, VPN providers often have physical servers in one country while their IP addresses are registered to another country, and this discrepancy can also create issues. Let’s take a closer look at each of these problems individually, so you can find the fix that works best for you. 

WebRTC leaks expose your real IP address

WebRTC is an open-source technology that lets your browser reduce latency when engaged in high-bandwidth tasks like streaming or video calls. Based on the IETF standard RFC 8828, it lets a website choose between your VPN server and your real IP address so it can establish the quickest path to transmit large amounts of data and reduce wait times or buffering. 

But the catch with WebRTC is that it exposes both your VPN server and ISP-assigned addresses to websites, which can reveal your real IP location and cause websites to reject your VPN server country. Firefox now comes with built-in protections to prevent WebRTC leaks, while Chrome and Edge support third-party extensions like WebRTC Control that you can use to eliminate these issues. To check if your browser is leaking your real IP address during WebRTC requests, you can use a free tool like BrowserLeaks.

DNS lookups point to the wrong country

Even when a browser isn’t leaking your real IP address, DNS resolvers may fetch inaccurate location information if their nearest servers are too far from your current location. For example, a user in São Paulo may be geolocated to Chile when using Google Public DNS because that’s where Google’s nearest resolvers are located. 

If you toggle on DNS leak protection in your VPN app, this will force websites to use your VPN’s resolver to perform DNS lookups. That often solves the problem, but, again, you can confirm the fix worked through a service like BrowserLeaks or IPLeaks.

Outdated databases point to wrong locations

Websites rely on IP databases like Maxmind, IP2Location, IPinfo, etc. to look up your exact location, but these databases get outdated quickly and need constant updating. Most of these databases also correct errors on request, but that takes some time. Also, each website has its own rules for how often it queries IP databases for updates.

Even when locations are updated in the actual database, a website may be sitting with outdated information unless it actively has refreshed it recently. MaxMind recommends doing this at least twice a week, but that’s ultimately up to the specific website.

Virtual servers don’t match their physical location

VPN providers often rely on virtual servers that use IP addresses registered in a different region than the server’s physical location. For example, ExpressVPN notes that it serves IP addresses in Bolivia, Ecuador, Peru, Uruguay, and Venezuela through servers located physically in Brazil. 

While this is usually to help with the lack of local infrastructure or strict surveillance laws in the region, many databases and analytics tools will flag the discrepancy for websites, leading to confusion and inconsistency regarding your actual server location. In these cases, your best bet is to switch your VPN server or use a dedicated IP address by signing up for a paid add-on for your VPN.

How to check for IP location mismatches for free

Before investing in a specific solution, it’s better to do a thorough lookup to make sure why your IP address is pointing to the wrong location and whether a WebRTC or DNS issue, virtual servers, or something else is the cause. Here’s how I’d go about it, step by step: 

1. We’ll start by recording your baseline IP address, country, city, and ASN. With your VPN disconnected, navigate to IPConfig.co on your browser to grab your default IP details. I like this tool because it’s free and uses echoip to pull your location data straight from Maxmind. If you prefer using Terminal instead of your browser, you can also run curl ifconfig.co/json to grab these details in plain text format.

2. Now connect your VPN server. Then visit IPConfig.co again to note down the changed details. 

3. Make sure the Country and Timezone fields match your current VPN server location. Also make sure the ASN (organization) field does not list your home ISP.

4. In case these details do not match your VPN server, run a WebRTC leak test and a DNS leak test using BrowserLeaks. If either of these tests doesn’t return your VPN server’s IP address, you’ve found your culprit.

5. If both the leak tests come back clean but a specific site still gets your location wrong, the issue is likely originating from an outdated database or virtual server. 

There’s no surefire way to solve IP location mismatches for good. But if it happens often enough to disrupt your internet use, you can consider switching to a different VPN server and getting a browser add-on that prevents WebRTC leaks. If that doesn’t work, I’d consider buying a dedicated IP address that isn’t based on a virtual server. While many IP databases like MaxMind or IP2Location also have ways to request a location correction, that takes a while to go through and isn’t worth the effort unless it’s a permanent IP address registered through your ISP.

A Roku isn’t as sensitive to the chosen HDMI port as a game console or sound bar, but you should still choose the right one for the job.

The new laptop goes the extra mile to recreate the iconic feature.

The US military is taking a new approach to prop up commercial launch companies as SpaceX looks to wind down its Falcon rocket program, suggesting defense officials see the workhorse rocket’s retirement as a potential national security risk.

The Pentagon’s Office of Strategic Capital has twice in the last two weeks announced it was sending cash to two of SpaceX’s competitors in the launch business. First, on October 26, the office announced a $150 million conditional loan commitment to Stoke Space. Military officials revealed a second $150 million Pentagon loan Tuesday for Rocket Lab.

Stoke Space and Rocket Lab are the first two launch companies to receive significant support from the Office of Strategic Capital (OSC), an organization established in 2022 to infuse companies developing “vital” national security technologies with capital. OSC has been on a loan spree in recent weeks, committing hundreds of millions of dollars to companies specializing in batteries, drones, and semiconductors. In the space sector, the office also provided a $150 million loan to LeoLabs, a commercial satellite tracking company, for production and deployment of radar units.

Read full article

Comments

Xiaomi’s HyperOS 4 update includes intriguing new features like Soft Light Glass, memory improvements and more, but the not everyone will get the perks.

Amazon is betting that many Ring customers will also want an AI-powered security drone and robot patrolling their homes or offices. But the company’s upcoming Ring Robotic products are also certain to intensify privacy concerns previously raised around a prior Amazon attempt to popularize a flying security camera.

The Ring Rover Cam and Ring Drone Cam are expected to reach customers starting at the end of 2026 and in early 2027, respectively, according to an Amazon announcement posted on November 10. Amazon describes the devices as relying on an AI Pilot system that uses each device’s cameras along with “specialized vision models, on-device sensors and cloud processing” to plan patrol routes while autonomously navigating around obstacles such as furniture.

Both devices also use that AI Pilot system to digitally map the floor plan of the customer’s home or business. This setup process occurs after the customer carries the Ring drone through their indoor spaces or allows the Ring Rover to do some autonomous exploration.

Read full article

Comments

Fireworks AI says its October breach was broader than initially disclosed, with attackers gaining access to customer account and billing information as well as some datasets, incomplete model weights and secrets. Notion, the popular productivity and note-taking app, disclosed that it was impacted in the breach but “fewer than 1% of Notion workspaces” were involved. “Upon analysis of the new data, we discovered that it included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable,” it said. “‘Unattributable’ means the chats weren’t labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results.” The Hacker News reports: In a notice published on October 10, 2026, [Fireworks AI] said it detected unauthorized use of internal Fireworks credentials that allowed an unauthorized third-party to access environment variables used in evaluation jobs in a limited number of customer accounts. The activity was detected on October 6, 2026, at 9 a.m. PDT. […] The latest bulletin from the company reveals that the scope of the breach may have been broader than previously thought. The company said attackers reached its development environment via an unnamed third-party cloud provider that hosted Fireworks research and development (R&D) machines on October 23, 2026.

“On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact,” it added. “As of October 25, we have not detected further evidence of successful unauthorized access by the threat actor on the Fireworks platform customers use.” The breach is said to have provided access to the following types of information: [Resource metadata; Billing information; and Model weights and datasets]. Fireworks AI said payment card numbers are not stored by the company and were not impacted by the security incident. It also said it’s alerting customers whose data was impacted.

Read more of this story at Slashdot.

We may earn a commission from links on this page.

Of the three major macronutrients—protein, carbs, and fat—protein has the best reputation, and it’s fairly well deserved. We need significant amounts of protein in our diet, and nothing particularly bad happens if we get too much. Dietary protein helps you build muscle, and if you’re trying to lose weight it helps stop you from losing too much muscle along with the fat. It also helps to make meals feel filling. Great! But.

Once the general public gets the idea that something is good for you, the companies that make packaged food start putting it in everything. Or, they make products where the good-for-you thing features prominently on the label, whether or not there is very much inside. So a lot of packaged food now boasts protein on the label. Here’s what you should ask yourself about those foods:

Look at how much protein is actually in it

Take a close look here—sometimes a food will boast of a certain amount of protein per package but the package contains two or three servings. Other times, the protein per serving is correct, and we’re supposed to be excited to have, say, 7 grams per serving. That’s just not very much—and certainly not worth paying extra or choosing a less-delicious food just for those few added grams.

It’s good to know how much protein you need in your diet. If you’re not gaining or losing weight, and not doing very much exercise, a 150-pound person only needs about 54 grams of protein a day. (I’ve done the math for various body weights here.) If you’re working out a lot, or if you’re trying to gain or lose weight (yep, either way), that same 150-pound person will need more like 81 to 95 grams of protein per day. More is OK, but not necessary.

So if you’re trying to get 90 grams per day, 30 grams per meal is a reasonable amount to shoot for. Coincidentally, 30 grams is the amount of protein that tends to make a meal feel satisfying. You can do the math to figure out whether a protein-added product is going to be helpful in your day’s diet.

What would you eat if you weren’t eating this?

I think this is the most important question about protein-added foods. It’s not hard to get protein in a meal; meats, dairy, tofu, beans, and grains all tend to supply plenty. So what is this protein-added thing you’re considering, and are you eating it instead of a traditional meal?

Here’s an example. If I’m heading straight from the gym to run some errands, and I need something to substitute for a meal—yeah, this isn’t great planning, but sometimes it happens—a protein bar with 20 grams of protein is a step in the right direction. Much better than a candy bar, anyway.

But then there are things like this “protein mix” trail mix: 7 grams of protein with 200 calories. A double serving would be 400 calories and only 14 grams of protein. Hardly a great choice if your goal is just to add to your protein intake for the day.

And then there are the chips that my kid, for a time, couldn’t stop eating. He loves Doritos and such; on a whim, we bought him some protein chips (yes, these are a real thing). Are they better for him than the equivalent amount of Doritos? Arguably, sort of yes. But then he started arguing that since they have protein, he should be able to eat them in place of dinner. We nixed that, but admit it: Are you having that same argument with yourself, feeling better about a snack food because it contains extra protein? If so, the marketing is working—you’re feeling good about your supposedly healthy choices, even though you’re just eating a bag of chips.