Topic
Mass harvesting of browser cookies, credentials and browsing data enabling session replay against victim accounts.
FlashPoint pulled 555 AI-service tokens out of a single 44,791-token stealer dump, 24 of them still valid, and five dollars is the Telegram bulk price because a copied session leaves the victim's own login working.
Reality
Prosecutors in Ukraine's Lviv region say three men spent about a year harvesting Roblox session cookies and running them through software that valued each account before sale. They put the potential take at $480,000.
Reality
Socket traced six Chrome and Firefox listings to one publisher operation whose collector reaches for Firebase access tokens and Axiom bundle keys. Chrome pulled four in July 2026. The Firefox one is still up.
Reality
CloudSEK says the kit's JavaScript disrupts FIDO2 on a cloned Microsoft 365 login and steers the victim to TOTP, SMS or push, so the tenant's authentication strength policy decides whether the relay works.
Reality
The company told affected customers by email, with nothing on its status page, and the only symptom on the user's side was usage that refilled and drained on its own. Watching that burn is now the account holder's job.
Reality
Island says the kit relays Microsoft 365 sign-ins behind genuine Docusign envelopes and legitimate Microsoft or Google redirects, leaving sender reputation nothing to grade.
Reality
Fake Rockstar pages push a 1.1 MB Vidar sample that takes session cookies as well as saved passwords. Cookies replay past 2FA, which makes this a corporate access problem wearing a consumer costume.
Reality
Broadcom's Threat Hunter Team says the same small team, the same infrastructure and one control panel serve both Chinese state espionage and a crypto-fraud sideline. Actor-type triage does not survive that.
Reality