Malicious actors are exploiting stolen session tokens and API keys harvested by infostealers to gain unauthorized access to AI platforms, often evading even multi-factor authentication. Tools like Lumma Stealer and Vidar have been discovered capturing login credentials as well as session and API secrets from victims’ machines. These stolen tokens are then packaged into stealer logs and traded through underground forums, setting the stage for large-scale account takeover threats.
What the compromise reveals
A 7 GB dump of stealer logs made public on a Telegram channel in early August 2026 exposed data from 5,871 infected systems across 162 countries. Among the stolen credentials were nearly 45,000 distinct JSON Web Tokens (JWTs), with at least 1,843 confirmed still-valid tokens capable of granting access. Of those, 555 JWTs appear directly linked to AI services. Equally alarming: 2,937 encrypted JSON Web Encryption (JWE) tokens were also part of the dump, many tied to AI platforms. Even if encrypted, these tokens can be replayed to impersonate a user if they haven’t yet expired.
Some of the affected platforms include Generative AI providers and tools like Google Gemini, Microsoft services, Anthropic’s models, Amazon-hosted solutions, Notion, Character.ai, Cursor, Poe.com and Pika AI. Victims’ unexpired session token theft enables attackers to bypass not only passwords but also MFA layers, as a valid non-expired JWT functions much like a skeleton key. Furthermore, around 17.7% of JWTs were found to expose plaintext personal identifiable information (PII) such as names, emails, and phone numbers — information that doesn’t vanish and heightens risk for phishing and social engineering.
Tools, techniques & underground marketplace
Attackers facilitating this type of account fraud are relying on a number of specialized tools. “Anti-detect” browsers like Camoufox, or automation frameworks like SeleniumBase, are being employed to load stolen session data from browser storage (sessionStorage and localStorage), then mimic legitimate users via proxy chains to evade detection triggers — including IP changes or device anomalies.
These stolen credentials and session dumps are increasingly listed for sale. One underground service is offering access to platforms such as Claude, Cursor, ChatGPT, and Gemini at reduced rates, with round-the-clock support and even refund guarantees. There are claims of “Poison Claude” offerings, purportedly giving access to multiple versions of Anthropic’s models: Opus 4.8, 4.7, 4.6, and Sonnet 4.6. The marketplace for AI token bundles and credentials continues to expand in tandem with increasing demand to exploit high-cost frontier models and powerful compute resources.
Defenses and risk mitigation
Organizations are being urged to adopt tighter controls over session tokens and API keys. Recommended strategies include using OAuth workflows and short-lived tokens, scoping API key permissions, and monitoring for signs of token reuse. Some protections already in place include IP allowlisting and device-bound session credentials (DBSC), such as those recently added by Chrome, which tie session tokens to specific device attributes.
Despite improvements like passkey-based authentication and protective mechanisms aimed at phishing resistance, experts warn these do little to guard against abuse of session tokens once in the hands of attackers. When attackers hold unexpired tokens or API keys, they can sidestep traditional login—and MFA—barriers entirely.
This entire trend underscores the evolving economics of cybercrime: as access to powerful AI models and compute becomes more expensive, the incentive to steal rather than purchase credentials grows correspondingly. Infostealer dumps are becoming diversified in what they offer—from credentials to session tokens to “AI accounts”—and threat actors are capitalizing on that shift.
This escalation in token reuse, AI account theft, and underground trading of access credentials should serve as a wakeup call. Companies and users alike must revisit existing identity and access management (IAM) strategies. Going forward, incident response teams should focus on token hygiene, tighter lifespans for access artifacts, continuous validation of device and location signals, and rethinking how to couple security with usability. The real question is when—rather than if—this kind of session-based breach delivers its next big exploit.
