Reported by 5 outlets

Infostealers Harvest Replayable AI Session Tokens

hot0.0

Why this score

Breadth: 2.00 / 2.0 · 5 sources
Authority: 1.80 / 2.0 · best outlet weight
Severity: 1.00 / 5.0 · CVSS + content signals
Velocity: 0.00 / 2.0 · updates in 48h
Pickup speed: 0.22 / 0.6 · time to second source
Recency: × 0.00 temporal multiplier
Community: + 0.00 / 1.5 · reddit signal
Score: 0.0 / 10 = base × recency + community

thehackernews.comokta.comunit42.paloaltonetworks.combleepingcomputer.comtheregister.com desk first seen 34d ago

Desk analysis

There is no CVE in this story because there is no bug to patch. Lumma Stealer and Vidar, working alongside StealC, RedLine, Acreed and Atomic Stealer on macOS, lift secrets that are already valid: browser session cookies, JWTs, encrypted JWEs and plaintext API keys for AI platforms, bundled as stealer logs and sold or given away on Telegram. Okta's analysis of a 7 GB dump released August 2, 2026 sizes one such batch at 5,871 infected machines across 162 countries holding 44,791 unique JWTs, of which 555 authenticated AI services, plus 2,937 JWE structures set mostly by OpenAI through NextAuth.js; 1,843 tokens were still unexpired on release day and 17.7 percent of the JWTs carried plaintext PII that never expires. A TruffleHog pass over the same dump surfaced 24 live API keys for Google Gemini, OpenAI, Groq and OpenRouter. Replay is the whole attack: a stolen session token authenticates as the victim with no password and no MFA prompt, which is why Anthropic spent late August forcibly signing users out, wiping saved payment methods and refunding unauthorized charges after Vidar and LummaC2 infections fed the theft of Claude sessions.

What makes this worse than ordinary credential theft is that one replay transfers four assets at once: a searchable archive of everything employees pasted into prompts, execution authority, standing OAuth grants into CRM and mail, and an unbounded billing line. SOCRadar's exposure data puts the victim pool at more than one million infostealer records tied to AI services across 80,000-plus corporate domains, narrowing to 482 major enterprises, 68 percent of them billion-dollar firms across 36 countries, holding 5,434 records tied to 1,500 corporate emails, with 295 of those companies appearing only in the last 90 days. ChatGPT or OpenAI sessions show up for 358 of the 482 and those firms carry roughly 90 percent of all records, which reads as a census of shadow AI rather than a verdict on any vendor; technology firms are the largest block at 144 companies, but LLM-platform exposure peaks in energy at 93 percent of affected companies. The claim the event list never quite makes: rotating the password evicts nobody, because the cookie is the session, so the remediation unit is the token, and the loss lands in cloud billing rather than in any security console, as in Unit 42's response cases approaching one million dollars in charges and the stolen METR key that burned $600,000 in credits over weeks without detection.

Start with the hunt, not the policy memo. Query stealer-log collections for corporate domains (SOCRadar's free checker covers 44 AI platforms), and treat any hit as an endpoint compromise with provider-side cleanup: revoke all sessions, rotate and reissue API keys, strip stored payment methods, reimage the machine. Kill the replay surfaces Okta calls out: IP allowlisting on AI apps defeats session replay outright, and API keys should move out of environment variables and config files into OAuth 2.0 flows with short-lived access tokens, refresh-token rotation, and scoping with usage caps, alerting on unfamiliar ASNs and odd-hour spend, the LLMjacking fingerprint. Concrete telemetry to chase: the Go-http-client/2.0 user agent with gzip(gfe) Unit 42 tied to malicious API calls, malicious login sources 117.72.74[.]48, 207.246.106[.]162, 23.236.182[.]215 and 95.214.112[.]26, transfer-station infrastructure amutes[.]com and abb1[.]life, and the fact that newer stealer builds ship regex and glob rules for Anthropic and OpenAI key formats and known AI-tool config paths, which makes those config paths themselves worth EDR coverage. Device Bound Session Credentials, present in Chrome 145 for Windows since March 2026 and rolled out with Chrome 146 in April, binds sessions to hardware, but it helps only where the provider implements it server-side, so it is a selection criterion for AI vendors today rather than a deployed control.

Two developments would change this assessment. The first is provider-side adoption of device-bound sessions: if OpenAI or Google ship DBSC-compatible authentication, the replay market collapses for those platforms while the rest of the 44 indexed platforms stay exposed, and pricing on the underground would say which. The second is the pivot: no confirmed case yet exists of a replayed AI session being used to reach enterprise data through standing OAuth grants, a stolen Zapier session scripting scheduled exfiltration from the vendor's own trusted IP space, and the SOCRadar data shows agent and automation exposure already concentrates in healthcare, financial services and technology. That first documented pivot converts this story from billing fraud into a reportable data breach, and it is the trigger to treat AI platforms as tier-one identity providers rather than ordinary SaaS.

Timeline

original reporting

🤖 Infostealer logs expose replayable AI session tokens: Lumma Stealer and Vidar harvest credentials/session tokens for AI platforms, enablin

thehackernews.com · 34d ago · September 9th, 2026

🤖 Infostealer logs expose replayable AI session tokens: Lumma Stealer and Vidar harvest credentials/session tokens for AI platforms, enablin

via Mastodon https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html
update from okta.com

Free tokens for sale: How fake signups drive AI fraud (Okta Threat Intelligence)

okta.com · 71d ago · August 4th, 2026

Okta Threat Intelligence researchers Jeremy Kirk and Mathew Woodyard published the first part of this research on August 4, 2026, documenting gray-market AI access services including Poison Claude, which resells Anthropic model access at 5-15 percent of official token prices using the US$100 AWS Bedrock bonus credit. An exposed unauthenticated /api/status route showed Poison Claude had 881 total and 872 active users, and a companion service Ecomagent.in claimed startup-credit-funded access to Opus 4.8, Sonnet 4.6 and GPT Codex 5.5. Okta notified Cloudflare and Anthropic before publication, and Cloudflare placed a phishing warning in front of poison-claude.bitsender[.]top.
update from thehackernews.com

Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt

thehackernews.com · 70d ago · August 5th, 2026

The Hacker News covered the Okta research on August 5, 2026, listing more than half a dozen underground services advertising illegal access to AI models, with Poison Claude provisioning customers an Anthropic-compatible API key and instructing them to redirect Claude Code via environment variables. The report noted the service's api.claudeopus[.]shop status endpoint leaked user counts (881 total, 872 active), that gateway-proxy configuration gives the operator full visibility into customer prompts, and that Ecomagent.in claimed roughly 970 users.
update from paloaltonetworks.com

Token Jacking: Cybercriminals Could Be Stealing Your AI Resources (Unit 42)

paloaltonetworks.com · 69d ago · August 6th, 2026

Unit 42 published this telemetry report on August 6, 2026, describing incident response cases where stolen or exposed AI API keys were integrated into gray-market transfer stations within minutes, generating nearly one million dollars in charges before discovery. It traces the demand side to proxy platforms built on the open-source new-api and one-api projects, flags npm supply chain campaigns such as Shai-Hulud and Miasma as credential sources, and publishes IoCs including the Go-http-client/2.0 user agent, malicious login source IPs, and transfer-station domains amutes[.]com and abb1[.]life.
update from bleepingcomputer.com

Anthropic warns infostealer malware is hijacking Claude sessions to drain usage

bleepingcomputer.com · 44d ago · August 30th, 2026

BleepingComputer reported on August 30, 2026 that Anthropic began emailing Claude users whose active sessions were stolen by infostealers and drained by attackers, naming Vidar, LummaC2, StealC, RedLine and Acreed on Windows plus Atomic Stealer (AMOS) on a small number of Macs. Anthropic revoked compromised sessions, removed saved payment methods and refunded charges it identified as unauthorized, and warned that signing users out does not remove the malware. One affected user traced the infection to a pirated game download.
update from theregister.com

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

theregister.com · 42d ago · September 1st, 2026

The Register reported on September 1, 2026 that an attacker stole an API key belonging to AI testing organization METR and consumed roughly $600,000 worth of model credits over several weeks before anyone noticed. Okta's September 9 report cites this case, alongside a $25,000 bill at a software firm and Unit 42's near-million-dollar response cases, as evidence that stolen AI credentials monetize through the victim's own billing.
update from bleepingcomputer.com

80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking

bleepingcomputer.com · 15d ago · September 28th, 2026

The summer of 2026 taught the security industry a new phrase: the stolen AI login. SOCRadar's AI Identity Exposure Report goes after the demand side: the enterprises whose employees are the credentials being sold. Starting from more than one million infostealer records tied to AI services across 80,000-plus corporate domains, the research narrowed the set to 482 major established enterprises to answer a single question: when an AI login lands in a stealer log, whose is it, and what does the buyer inherit? Of the 482, 68% are billion-dollar organizations across 36 countries and eight sectors, concentrated in North America, dozens of them Forbes-ranked. Between them sit 5,434 stealer-log records tied to 1,500 distinct corporate email addresses, and 295 of the 482 surfaced in the last 90 days. ChatGPT dominates the dataset; Hugging Face and Replit show developer tools are exposed as well Break the dataset down by platform and one name swallows the chart. A captured ChatGPT or OpenAI session shows up for 358 of the 482 companies, and those companies carry roughly 90% of all records in the study. Zapier, Notion, Hugging Face, Replit, Lovable, and ElevenLabs trail far behind.
update from www.bleepingcomputer.com

80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking https://www. bleepingcomputer.com/news/secu rity/80-000-plus-organi

www.bleepingcomputer.com · 15d ago · September 28th, 2026

80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking https://www.

Covered in

digest 2026-09-29