Reported by 2 outlets
Infostealers Are Stealing Cloud and AI Credentials From Infected Devices
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.31 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
Infostealers steal cloud and AI credentials by extracting saved passwords, API keys, and session cookies from infected devices. Wiz research published September 25 found that Lumma C2, RedLine, and Vidar accounted for 85.7% of analyzed incidents. Among compromised secrets, 46% were AWS-related, 13% Google Cloud, roughly 10% GitHub, and 5% AI platforms, mainly OpenAI API keys. A stolen session cookie is particularly dangerous: it can replay an existing login and bypass fresh MFA prompts, giving attackers access without new authentication.
The low-trust aggregator update (threadlinxs TL-2026-2757) repeats the claim about session cookies replaying past MFA to drain ChatGPT and Claude credits, but the primary source attribution was not independently verified at the named outlet. Without verified provenance, the event amplifies the existing story but does not add new fact.
What to watch: whether AI session token theft moves from infostealer dumps into active account-hijacking campaigns, and whether vendors add cookie-binding or shorter session lifetimes to limit replay.
Timeline
-
original reporting
Infostealers Are Stealing Cloud and AI Credentials From Infected Devices
cyberpress.org · 15d ago · September 28th, 2026
An infostealer infection on a developer’s laptop or personal computer can become an entry point into an organization’s cloud, source code, and AI services. The malware searches the device for passwords, API keys, and login tokens, then sends them to attackers who can use them to access business systems. In research published September 25, Wiz analyzed secrets detected on infected machines through its integration with NordStellar. Lumma C2, RedLine, and Vidar accounted for 85.7% of the detected incidents. Among the compromised secrets, 46% were associated with AWS, 13% with Google Cloud, roughly 10% with GitHub, and 5% with AI platforms , mainly OpenAI API keys. These figures describe Wiz’s analyzed data, not all infostealer infections. Infostealers Steal Cloud AI Credentials Infostealers often reach users through phishing, fake software downloads, or malicious advertising. A separate route targets developers through compromised software packages. Once running, the malware can collect saved browser data and files holding credentials. Operators package the stolen information into logs, which may be sold to brokers or used directly to break into organizations. A stolen session cookie is especially dangerous. It represents a login the user has already completed. If an attacker can reuse a valid cookie, they may enter the service without facing a new multifactor authentication prompt . Infostealers Steal Cloud AI Credentials (Source: wiz) The access they gain depends on the victim