So, social engineering was involved here. Also it's the first time I hear about buying stolen cookies