Infostealer Malware Hijacking AI Accounts via Session Token Replay

Cybercriminals are hijacking artificial intelligence (AI) user accounts by replaying stolen session tokens and API keys, a technique that effectively bypasses multi-factor authentication (MFA).

Researchers at Okta identified that threat actors are specifically targeting these credentials to gain illicit access to tools from major model providers, including Google, Anthropic, and OpenAI. By replaying stolen secrets, attackers can log into Large Language Model (LLM) services without ever needing a username, password, or MFA prompt.

The discovery follows an analysis of a 7 GB infostealer dump released on a Telegram channel in August 2026. The dataset contained information from 5,871 infected machines across 162 countries. Among the thousands of unexpired authentication tokens were those corresponding to services such as Google, Microsoft, Anthropic, Amazon, Notion, and AI platforms like Character.ai, Cursor, and Pika AI.

The Mechanics of Session Replay

Of the 44,791 unique JSON Web Tokens (JWTs) identified in the dataset, 555 were likely related to authentication for AI services. Additionally, the analysis identified 2,937 JSON Web Encryption (JWE) data structures, which represent encrypted JWTs. While these tokens are encrypted, attackers can still replay them to gain direct account access as long as they remain unexpired.

To execute these attacks, criminals often employ “anti-detect” browsers or automation tools such as Camoufox and SeleniumBase. These tools allow attackers to load stolen data from a browser’s local storage and configure proxies to bypass security triggers, such as “impossible travel” detections that flag logins from unusual geographic locations.

Beyond session tokens, an analysis using TruffleHog unearthed 24 valid API keys for AI-related services, including Google Gemini, OpenAI, Groq, and OpenRouter. The abuse of these keys is referred to as “LLMjacking,” a process where attackers hijack a victim’s compute resources for espionage, extortion, or to run expensive models on the victim’s billing account.

PII Exposure and Black Market Demand

The theft of these credentials also presents a significant privacy risk. Okta reported that 17.7% of the 44,791 JWTs contained plaintext personally identifiable information (PII), including names, phone numbers, and email addresses. Because this information does not expire, it can be used to facilitate long-term social engineering or phishing campaigns.

The demand for these stolen assets is growing. Google has observed an increase in personas seeking to purchase AI-related accounts across the cybercrime underground. Some vendors on Telegram are already selling discounted access to Claude, ChatGPT, and Gemini, occasionally offering money-back guarantees for access to high-end models like Anthropic’s Opus series.

Mitigation Strategies

Security experts recommend several technical controls to defend against session hijacking and LLMjacking:

• Device Binding: Using technologies like Google’s Device Bound Session Credentials (DBSC) in Chrome, which cryptographically links a session token to a specific hardware device.
• Network Restrictions: Implementing IP allowlisting to ensure traffic only originates from approved network ranges.
• Token Management: Utilising OAuth 2.0 flows with short-lived tokens that expire quickly to limit the window of opportunity for replay attacks.
• Phishing Resistance: Moving toward phishing-resistant authentication methods, such as passkeys, to secure the initial login process.