Skip to navigation

Threat reportThreat IntelligenceTL-2026-2416

Infostealer Logs Expose Replayable AI Session Tokens and API Keys Enabling MFA Bypass

highACTIVE

Okta analysis of a 7 GB infostealer dump published to Telegram on August 2, 2026 spanning 5,871 infected machines across 162 countries found 44,791 unique JWTs including 555 likely tied to AI service authentication, 24 still-valid API keys for Google Gemini, OpenAI, Groq, and OpenRouter, and plaintext PII in 17.7% of tokens. First disclosed .

Key facts for AI session token theft

IdentifiersTL-2026-2416
Also known asAI Session Token Campaign, Token Jacking Campaign, Operation Bizarre Bazaar
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsGoogle Gemini API; OpenAI ChatGPT / API; Anthropic Claude (Web + API); Microsoft Azure OpenAI / Entra ID; Amazon AWS Bedrock; Groq LLM API; OpenRouter LLM API Gateway
MalwareCASTLELOADER, Lumma Stealer - S1213, LummaC2 / Lumma Stealer, RedLine, Stealc, Vidar
ToolsAI LLM endpoints (LLM), Camoufox, NORDSTREAM, QUIETVAULT
MITRE ATT&CK techniquesT1005 Data from Local System, T1027 Obfuscated Files or Information, T1053 Scheduled Task/Job, T1055 Process Injection, T1059 Command and Scripting Interpreter, T1195 Supply Chain Compromise, T1496 Resource Hijacking, T1528 Steal Application Access Token, T1539 Steal Web Session Cookie, T1555 Credentials from Password Stores, T1566 Phishing, T1567 Exfiltration Over Web Service and 2 more in the attack flow
MotivationFINANCIAL
Target sectorstechnology, cloudcomputing, artificialintelligence, saas, finance, government administration, health
Target regionsWorldwide
Detection rules9 (1 shown free)
Sources15 cited sources

Detection coverage for AI session token theft

As of 2026-09-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2416 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Infostealer Delivery via Malvertising ClickFix and PowerShell Download Cradle

Detects infostealer delivery via malvertising lures using ClickFix fake CAPTCHA pages that execute PowerShell download cradles. LummaC2 and Vidar are commonly distributed through fake Notepad++ and Chrome update ads redirecting to attacker-controlled domains (including community-observed futupath.cyou and smarture.cyou). Detects browser process spawning PowerShell with a download cradle invoking Start-BitsTransfer, Invoke-WebRequest, or wget/curl patterns to fetch second-stage payloads.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566, T1189, T1059.001, T1027
  • Data sources: sysmon, windows_process_creation, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\chrome.exe" OR ParentImage="*\msedge.exe" OR ParentImage="*\firefox.exe" OR ParentImage="*\brave.exe")
  (Image="*\powershell.exe" OR Image="*\pwsh.exe")
  (CommandLine="*Invoke-WebRequest*" OR CommandLine="*iwr*" OR CommandLine="*Start-BitsTransfer*" OR CommandLine="*Invoke-RestMethod*" OR CommandLine="*curl*" OR CommandLine="*wget*")
  | eval delivery_method=case(CommandLine LIKE "%BITSAdmin%" OR CommandLine LIKE "%Start-BitsTransfer%", "BITS_Transfer", CommandLine LIKE "%Invoke-WebRequest%" OR CommandLine LIKE "%iwr%", "PowerShell_WebRequest", 1=1, "Other_Cradle")
  | eval threat_ioc=case(CommandLine LIKE "%futupath.cyou%" OR CommandLine LIKE "%smarture.cyou%", "Known_Lumma_C2", 1=1, "Suspicious_Cradle")
  | table _time, ComputerName, User, ParentImage, Image, CommandLine, delivery_method, threat_ioc
  | sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoProductName in ("PowerShell", "pwsh")
| where InitiatingProcessFileName in ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe")
| where ProcessCommandLine has_any ("Invoke-WebRequest", "iwr", "Start-BitsTransfer", "Invoke-RestMethod", "curl -o", "wget", "BITSAdmin")
| extend DeliveryMethod = case(ProcessCommandLine has "BITSAdmin" or ProcessCommandLine has "Start-BitsTransfer", "BITS_Transfer", ProcessCommandLine has "Invoke-WebRequest" or ProcessCommandLine has "iwr", "PowerShell_WebRequest", ProcessCommandLine has "curl -o" or ProcessCommandLine has "wget", "Native_Utility", "Other_Cradle")
| extend ThreatIndicator = case(ProcessCommandLine has "futupath.cyou" or ProcessCommandLine has "smarture.cyou", "Known_Lumma_C2", "Suspicious_Cradle")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, DeliveryMethod, ThreatIndicator
| order by Timestamp desc

Sigma

title: Infostealer Delivery via ClickFix PowerShell Cradle from Browser
id: fa1b3c2d-8e9f-4a0b-bc5d-6e7f8a9b0c1d
status: experimental
description: Detects browser process spawning PowerShell with a download cradle pattern consistent with ClickFix fake CAPTCHA malvertising delivery of Lumma, Vidar, and other infostealers.
author: AII-Detector - ThreadLinqs Intelligence
date: 2026-09-09
references:
  - https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html
  - http://www.okta.com/blog/threat-intelligence/free_tokens_for_sale/
  - https://unit42.paloaltonetworks.com/ai-token-jacking/
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1189
  - attack.t1059.001
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cradle:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'Start-BitsTransfer'
      - 'Invoke-RestMethod'
      - 'curl -o'
      - 'curl.exe -o'
      - 'wget '
      - 'BITSAdmin'
  condition: selection_parent and selection_child and selection_cradle
falsepositives:
  - Legitimate browser-initiated downloads via enterprise software update mechanisms
  - Administrators testing web connectivity from browser developer tools
  - Browser-based IDEs or cloud workstations that legitimately invoke PowerShell
level: high

Known false positives:

  • Enterprise software update systems that use browser-triggered PowerShell downloads
  • Administrators performing legitimate web debugging from browser consoles
  • Browser-based cloud workstation environments

Tuning notes: Baseline enterprise software update mechanisms that use browser-spawned PowerShell to reduce noise. Add known-good browser extension paths to exclusion list. Community-observed Lumma C2 domains (futupath.cyou, smarture.cyou) can be escalated to alert with higher severity.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • npm Supply Chain Attack via Malicious Postinstall Script with Permission-Bypass CLI Flags · unlock with TL Creds
  • Browser Credential Store Access - Suspicious LSASS and Chrome Cookie Database Reads · unlock with TL Creds
  • Data Exfiltration Over Telegram and Social Media - Infostealer Log Upload to C2 · unlock with TL Creds
  • EtherHiding - Binance Smart Chain Smart Contract Malware Hosting · unlock with TL Creds
  • AI CLI Tool Abuse - Claude Code, Gemini CLI, Amazon Q with Permission-Bypass Flags · unlock with TL Creds
  • Anti-Detect Browser and Session Injection - Camoufox and Cookie Import Detection · unlock with TL Creds
  • Chrome App-Bound Encryption Bypass via Process Injection for Credential Theft · unlock with TL Creds
  • AI Session Token Replay and LLMJacking via Anomalous AI API Access · unlock with TL Creds

Indicators of compromise for AI session token theft

As of 2026-09-09, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2416.

Sample indicators (3 of 17)

  • Domain: poison-claude[.]bitsender[.]top
  • Domain: api[.]claudeopus[.]shop
  • Domain: ecomagent[.]in

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

17 indicators of compromise · unlock with TL Creds. Compare plans

How AI session token theft works

Stolen sessions replayed against Google, Anthropic, OpenAI, and other LLM platforms bypass username/password and MFA, enabling LLMjacking, resource theft, and extortion. Mandiant documented one incident where an exposed GitHub PAT led to unauthorized AI infrastructure deployment in a victim's cloud environment via the UNC6426 threat cluster abusing an npm supply chain attack.

In early August 2026, a 7 GB archive of infostealer logs was published to a Telegram channel, exposing data from 5,871 infected machines across 162 countries. Okta's threat intelligence team analyzed the dump and identified 44,791 unique JSON Web Tokens (JWTs), of which 555 were likely tied to AI service authentication, and 2,937 JWE structures (encrypted JWTs set by OpenAI via NextAuth.js). Notably, 1,843 JWTs and JWEs remained unexpired on the release date, and 17.7% of all tokens contained plaintext personally identifiable information (PII) including names, phone numbers, and email addresses that never expire or disappear.

Using automated scanning tools including TruffleHog, Okta validated 24 still-active API keys for AI services across Google Gemini, OpenAI, Groq, and OpenRouter. These API keys enable LLMjacking — unauthorized use of cloud-hosted LLM inference capacity — where attackers route requests through subscription accounts they have not paid for, running up compute bills charged to the original account holder. Financial exposure can reach $46,000 per day per victim for AWS Bedrock deployments, and over $100,000 per day for frontier model access. The attack chain exploits a fundamental session security gap: a valid session token issued after successful MFA is stored in the browser and can be exfiltrated by infostealer malware, then replayed from a different device with no additional authentication.

Two infostealer families were identified as primary harvesters: Lumma Stealer (LummaC2) and Vidar. Both employ advanced browser data extraction techniques, including defeating Google Chrome v127+ App-Bound Encryption (ABE) through process injection — Lumma uses QueueUserAPC() to inject into chrome.exe and call Chrome's IElevator COM interface from within the trusted process, while Vidar uses NtCreateProcessEx to fork the browser's memory and APC injection to call CryptUnprotectMemory. These techniques allow extraction of HttpOnly and Secure-flagged cookies with full session validity. Delivery mechanisms include phishing campaigns, malvertising (fake Notepad++ and Chrome update ads), ClickFix fake CAPTCHA lures that execute PowerShell commands, EtherHiding via Binance Smart Chain smart contracts for malware hosting, and cracked software downloads.

The stolen credentials feed an established underground economy. Okta documented Telegram vendors selling discounted access to Claude, Cursor, ChatGPT, and Gemini with 24/7 support and money-back guarantees. A service called "Poison Claude" (poison-claude.bitsender[.]top) resells access to Anthropic models including Opus 4.8, Opus 4.7, and Sonnet 4.6 at 5-15% of official per-token pricing; a misconfigured API endpoint revealed 881 total and 872 active users. Ecomagent.in operates similarly with ~970 users and claims to support Opus 4.8/5, Fable 5, Sonnet 5, and GPT-5.6 on flat monthly subscriptions from $19/month. A broader operation, Operation Bizarre Bazaar, mapped 35,000 attack sessions between December 2025 and January 2026 through the silver.inc marketplace, which resold access to 30+ LLM providers at 40-60% discounts and was attributed to a threat actor using the alias "Hecker."

Google's Mandiant team documented the UNC6426 threat cluster, which exploited the downstream consequences of the August 2025 s1ngularity npm supply chain attack. A malicious npm package executed a QUIETVAULT credential-stealing postinstall script that harvested GitHub Personal Access Tokens, npm tokens, SSH keys, cloud provider credentials, and AI tool configuration files. QUIETVAULT notably detected locally installed AI CLI tools — Claude Code, Google Gemini CLI, and Amazon Q Developer — and invoked them with permission-bypass flags (--dangerously-skip-permissions, --yolo, --trust-all-tools --no-interactive) to recursively scan the filesystem for additional sensitive material. This is the first documented instance of AI CLI tool weaponization within a supply chain postinstall script. The stolen PAT was used with NORDSTREAM (an open-source CI/CD extraction tool) to enumerate workflows and trigger GitHub Actions, exploiting an AWS OIDC trust policy lacking a scoped sub condition to achieve full AWS administrator access in under 72 hours, ultimately stealing 2,349 distinct secrets from 1,079 compromised repositories.

The Flare 2026 State of Enterprise Infostealer Exposure report provides broader context: 2.05 million infostealer logs exposed enterprise identity credentials in 2025 alone, with ~1.17 million logs containing both credentials and live session cookies enabling immediate MFA bypass. Enterprise identity exposure rose from ~6% of infections in early 2024 to ~16% in early 2026. Microsoft Entra ID appeared in 79% of enterprise identity logs. Despite a 20% year-over-year decline in total infostealer infections, enterprise identity exposure continued rising, indicating a structural shift toward targeted high-value enterprise credential theft.

Defensive recommendations include deploying Google's Device Bound Session Credentials (DBSC) in Chrome 145+ (which cryptographically binds session tokens to a specific device using TPM/Secure Enclave), implementing phishing-resistant FIDO2/WebAuthn MFA, continuous access evaluation, short-lived OAuth tokens with automatic rotation, scoped API keys per service, IP allowlisting for AI API endpoints, and proactive monitoring of organizational domains against leaked-log corpora. Okta noted that even passkeys do not prevent a stolen session token or API key from being replayed.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection

Persistence

T1053 Scheduled Task/Job

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1195 Supply Chain Compromise; T1566 Phishing

Impact

T1496 Resource Hijacking

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

Remediation for AI session token theft

Patches

  • Update all browsers to latest versions supporting App-Bound Encryption (Chrome 127+ with ABE)
  • Implement FIDO2/WebAuthn phishing-resistant MFA across all identity providers
  • Deploy Endpoint Detection and Response (EDR) with process injection detection rules

Immediate actions

  • Rotate all credentials and API keys on potentially compromised systems
  • Revoke all active session tokens for AI service accounts
  • Block known malicious domains (poison-claude.bitsender.top, api.claudeopus.shop, ecomagent.in, silver.inc) at perimeter
  • Enforce credential rotation for all AI service accounts and cloud provider access keys
  • Force logout of all active sessions across AI platforms

Workarounds

  • IP allowlisting for AI API endpoints where operationally feasible
  • Use managed/compliant-device policies for accessing sensitive AI service consoles
  • Split production and development API keys with separate rate limits and budgets
  • Implement usage quotas and budget alerts on all AI/LLM API subscriptions

Longer-term hardening

  • Deploy Google Device Bound Session Credentials (DBSC) in Chrome 145+ to cryptographically bind session tokens to devices
  • Implement continuous access evaluation (CAE) to force re-authentication on IP/device/risk signal changes
  • Enforce short-lived OAuth tokens with automatic rotation (maximum 1-hour expiry for API keys)
  • Deploy scope-limited, per-service API keys with resource-level IAM policies
  • Implement AI service usage anomaly detection with secondary authentication signals
  • Monitor organizational domains against leaked-infostealer-log corpora (Flare, HudsonRock, SpyCloud)

Affected and fixed versions

  • Google — Gemini API
  • OpenAI — ChatGPT / API
  • Anthropic — Claude (Web + API)
  • Microsoft — Azure OpenAI / Entra ID
  • Amazon — AWS Bedrock
  • Groq — LLM API
  • OpenRouter — LLM API Gateway

Timeline of AI session token theft

  • s1ngularity npm supply chain attack launches; locked-ioc-12 postinstall script harvests credentials from 1,079 repositories
  • Operation Bizarre Bazaar begins; attackers scanning for exposed Ollama, vLLM, and MCP endpoints
  • Flare 2026 stats report indicates 2.05 million infostealer logs with enterprise credentials in 2025 and 1.17 million with live session cookies enabling immediate MFA bypass
  • Sysdig and Pillar Security Research document Operation Bizarre Bazaar; 35,000 attack sessions captured, locked-ioc-11 marketplace unmasked
  • Law enforcement disruption of Lumma C2 domains; thousands of domains taken offline
  • Google DBSC becomes generally available in Chrome 145 on Windows, cryptographically binding session tokens to specific devices via TPM
  • 7 GB infostealer dump published to Telegram — 5,871 infected machines, 44,791 JWTs, 555 AI-service tokens, 24 still-valid API keys for Gemini, OpenAI, Groq, OpenRouter
  • Okta publishes 'Free Tokens for Sale: How Fake Signups Drive AI Fraud'; documents Poison Claude, locked-ioc-8, and the gray market AI access ecosystem
  • IT Pro reports on criminals selling discounted AI tokens; identifies the Poison Claude proxy model and user base of 872 active users
  • Anthropic warns users that infostealers (locked-ioc-17, LummaC2, locked-ioc-16, Raccoon, locked-ioc-15, Arcid, M0S) are clawing session cookies to drain paid accounts
  • SecurBlink reports on infostealer malware hijacking Claude sessions; Unit 42 'Token Jacking' research documents traffickers reselling access at 87-93% below list price
  • Lunar Cyber publishes 'Token Haystack' analysis of parsing exposed tokens from stealer logs
  • The Hacker News publishes the exposure of replayable AI session tokens; threat ID TL-2026-2416 created

Sources cited for AI session token theft

Previous and next in threat intel

Drafted by the Threadlinqs research pipeline from 15 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats