Vercel says it is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a defence against attacks that rely on stolen session cookies. For businesses using cloud platforms, developer tools and SaaS services, the update highlights a growing security issue: malware that steals browser session data can let attackers bypass passwords and, in some cases, multi-factor authentication.

What happened

According to the reported announcement, Vercel is deploying DBSC to better protect user sessions on its platform. The purpose of this type of protection is to bind a logged-in session to a specific device, making it more difficult for an attacker to reuse a stolen session cookie on another machine.

Session cookies are commonly used to keep users logged in after authentication. If malware on an employee device steals those cookies, attackers may be able to hijack active sessions without needing the original login credentials. This has become a common technique in account takeover campaigns linked to information stealer malware.

Why it matters for European businesses

For European companies, the issue is not limited to one platform. Many businesses rely on browser-based access to cloud infrastructure, CMS platforms, analytics tools, ad accounts, CRM systems, code repositories and e-commerce back ends. If an attacker can reuse a stolen session, the impact can include unauthorised access to source code, website settings, deployment pipelines, customer information or marketing assets.

That makes session security a practical business risk, especially for companies with distributed teams, contractors or agencies accessing multiple services from standard web browsers. Even where multi-factor authentication is enabled, stolen session cookies can reduce its effectiveness if the session itself is not better protected.

Vercel's move also reflects a broader shift in SaaS security. Providers are looking for ways to limit the damage caused by infostealer malware, which has become a frequent entry point for breaches affecting business accounts and digital operations.

Who may be affected

• Development and IT teams using Vercel or similar cloud platforms for hosting, deployment and application delivery
• E-commerce businesses whose storefronts, front-end applications or integrations depend on browser-based admin access
• Marketing teams and agencies managing websites, analytics, tags and third-party platforms through shared business accounts
• SMEs and founders that rely on SaaS tools but may have limited endpoint security or identity monitoring

What companies should consider

• Review session security exposure: identify which critical business systems rely heavily on browser sessions, especially hosting, admin, analytics, CRM and advertising platforms.
• Do not rely on MFA alone: multi-factor authentication remains important, but it may not stop session hijacking if malware steals active cookies.
• Strengthen endpoint protection: infostealer malware usually starts on an employee device, so endpoint detection, patching and browser hygiene remain important.
• Limit account privileges: reduce the impact of a compromised session by applying least-privilege access and separating admin accounts from day-to-day use.
• Monitor SaaS security features: where providers introduce protections such as device binding, hardware-backed authentication or stronger session controls, evaluate whether they are enabled and how they affect internal access policies.
• Prepare for incident response: make sure teams know how to revoke sessions, rotate credentials and review suspicious logins if a device is suspected to be infected.

While this rollout is specific to Vercel, the underlying lesson is broader for European businesses: protecting passwords is no longer enough if browser sessions can be stolen and reused. Companies that depend on cloud platforms for websites, applications and digital operations should treat session hijacking as a real operational and security risk.