CTI · reviewed · 2026-09-29

Infostealers Harvest Replayable AI Session Tokens

Full story & timeline

Actors

—

Malware / tools

LummaVidarStealCRedLineAcreedAtomic Stealer

Campaigns

—

CVEs

—

Victim sectors

technologyenergyfinancial serviceshealthcare

Geography

—

MITRE ATT&CK

T1566 Phishing Initial Access
T1528 Steal Application Access Token Credential Access
T1539 Steal Web Session Cookie Credential Access
T1552 Unsecured Credentials Credential Access
T1657 Financial Theft Impact

Indicators

Observables tied to this case, from the curated feed. raw sidecar

api.claudeopus domain · expired
poison-claude.bitsender domain · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Sign-In From Known AI Token Theft Login Source
id: 9f4b27e0-6d13-4a88-b2c5-71ae9d3f5c46
status: experimental
description: Detects successful authentication from source IPs that Unit 42 documented as malicious login origins used with stolen or exposed AI API keys and session tokens integrated into gray-market transfer stations. A hit means a stolen token is being replayed from attacker infrastructure — treat as LLMjacking in progress.
references:
  - https://unit42.paloaltonetworks.com/ai-token-jacking/
  - https://www.okta.com/blog/threat-intelligence/free_tokens_for_sale/
author: Tia N. List
date: 2026/09/29
tags:
  - attack.t1528
  - attack.t1539
  - attack.credential-access
logsource:
  category: authentication
detection:
  selection:
    src_ip:
      - 117.72.74.48
      - 207.246.106.162
      - 23.236.182.215
      - 95.214.112.26
  condition: selection
falsepositives:
  - Very low: these IPs were published as attacker login sources; expect false hits only if the ranges are recycled after takedown
  - Analyst or threat-hunting traffic from the indicator itself
level: high