Stolen AI Tokens in Infostealer Logs Bypass MFA

A new analysis of infostealer logs shows that stolen session tokens and API keys are being replayed to take over artificial intelligence accounts without a password or multi-factor authentication. Okta, an identity services provider, examined a 7 GB information stealer dump that appeared on a Telegram channel on August 2, 2026. The dump held data from 5,871 infected machines across 162 countries. Among the stolen records were thousands of unexpired authentication tokens for services including Google, Microsoft, Anthropic, Amazon, Gamma, Notion, Character.ai, Cursor, Poe.com and Pika AI. Information stealers such as Lumma Stealer and Vidar are malicious programs that quietly collect credentials, session tokens and API keys from a compromised computer, and these stolen records are then sold on underground forums as stealer logs.

Within that dataset, Okta found 44,791 unique JSON web tokens, or JWTs. A JWT is a compact digital pass that proves who you are to a server. Of those, 555 were likely related to authentication for AI services. The company also identified 2,937 JSON Web Encryption structures, known as JWEs, which are encrypted versions of such tokens. Most of these encrypted tokens are said to have been set by OpenAI, which uses a tool called NextAuth.js. Even when a token is encrypted and cannot be read without the right key, attackers can still replay it to enter an account as long as it has not expired. In total, the stolen data contained 1,843 unexpired JWTs and JWEs on the day it was released. Okta also found that 17.7 percent of the 44,791 JWTs included plaintext personally identifiable information such as a name, phone number or email address. Kirk noted that this information does not expire and directly links a user to a specific service, which can help in social engineering or phishing.

Okta's report, shared with The Hacker News, explains that session tokens and API keys are especially valuable to attackers because replaying them bypasses credential-based authentication and multi-factor authentication. Jeremy Kirk, Okta's director of threat intelligence, said that once a token is successfully replayed, the attacker is effectively logged in to an LLM service without actually logging in, and this abuse is harder but not impossible to detect. He added that stronger authentication and phishing-resistant technologies such as passkeys have made username-and-password takeovers harder, but they do not stop a stolen session token or API key. However, session replay attacks may fail when an organization uses IP allowlisting, which blocks traffic except from approved addresses. Google has also added Device Bound Session Credentials, or DBSC, to Chrome to cryptographically tie a session token to a device so a stolen token cannot be used on another system.

Using the open source secret scanning tool TruffleHog, Okta also unearthed 24 still-valid API keys for four AI-related services: Google Gemini, OpenAI, Groq and OpenRouter. An attacker holding such a key can use it for espionage, extortion or resource theft, and can run up large AI token bills on the victim's account. This abuse of stolen API keys to use a victim's large language model without permission, or to sell that access to other criminals, is known as LLMjacking. The technique resembles campaigns that secretly use a system's computing power to mine cryptocurrency while the victim pays the bill. Okta says the surge in enterprise AI adoption has widened the ways criminals can monetize stolen data, and new black market sites now sell stolen token bundles and anti-detect browsers.

Underground sellers are already packaging access to popular AI tools. In one Telegram post flagged by Okta, an unspecified vendor offered access to Claude, Cursor, ChatGPT and Gemini at a discount, with 24x7 support and money-back guarantees. Another service called Poison Claude claims to provide access to Anthropic's Opus 4.8, Opus 4.7, Opus 4.6 and Sonnet 4.6 models. Okta explains that using stolen session data requires special tooling. Anti-detect browsers have features designed to load stolen authentication data and avoid security controls. Open source tools such as the anti-detect browser Camoufox and the automation tool SeleniumBase can load sessionStorage and localStorage data from a file, and many allow proxies that make an attacker's traffic look local and bypass impossible travel or behavioral alerts. Google disclosed that it has observed more buyers and sellers of AI-related accounts across cybercrime forums, with demand for Claude and Gemini credentials as well as autonomous coding tools such as Cursor Pro and Devin. In one incident response handled by Google's Mandiant team, a threat actor gained initial access through an exposed GitHub personal access token and used it to deploy unauthorized AI infrastructure and scale high performance compute resources. Google Threat Intelligence Group said the cost of premium model access and compute is a major barrier for criminals, which has led to more targeting, exfiltration and sale of AI accounts and more intrusions that hijack cloud compute.

The findings point to a pressing need to secure access to AI systems, monitor for session token reuse, scope API keys and use OAuth 2.0 flows with short lived tokens that expire quickly if stolen. Kirk said that as frontier model access becomes more expensive, the incentive to steal rather than pay for it grows. For organizations that run websites, cloud services or AI tools, AEU-I offers security-first IT, infrastructure and consulting that can help review token scopes, API access and session policies across their infrastructure.