In early August 2026, a 7 GB archive of infostealer logs was published to a Telegram channel, exposing data from 5,871 infected machines across 162 countries. Okta's threat intelligence team analyzed the dump and identified 44,791 unique JSON Web Tokens (JWTs), of which 555 were likely tied to AI service authentication, and 2,937 JWE structures (encrypted JWTs set by OpenAI via NextAuth.js). Notably, 1,843 JWTs and JWEs remained unexpired on the release date, and 17.7% of all tokens contained plaintext personally identifiable information (PII) including names, phone numbers, and email addresses that never expire or disappear.

Using automated scanning tools including TruffleHog, Okta validated 24 still-active API keys for AI services across Google Gemini, OpenAI, Groq, and OpenRouter. These API keys enable LLMjacking — unauthorized use of cloud-hosted LLM inference capacity — where attackers route requests through subscription accounts they have not paid for, running up compute bills charged to the original account holder. Financial exposure can reach $46,000 per day per victim for AWS Bedrock deployments, and over $100,000 per day for frontier model access. The attack chain exploits a fundamental session security gap: a valid session token issued after successful MFA is stored in the browser and can be exfiltrated by infostealer malware, then replayed from a different device with no additional authentication.

Two infostealer families were identified as primary harvesters: Lumma Stealer (LummaC2) and Vidar. Both employ advanced browser data extraction techniques, including defeating Google Chrome v127+ App-Bound Encryption (ABE) through process injection — Lumma uses QueueUserAPC() to inject into chrome.exe and call Chrome's IElevator COM interface from within the trusted process, while Vidar uses NtCreateProcessEx to fork the browser's memory and APC injection to call CryptUnprotectMemory. These techniques allow extraction of HttpOnly and Secure-flagged cookies with full session validity. Delivery mechanisms include phishing campaigns, malvertising (fake Notepad++ and Chrome update ads), ClickFix fake CAPTCHA lures that execute PowerShell commands, EtherHiding via Binance Smart Chain smart contracts for malware hosting, and cracked software downloads.

The stolen credentials feed an established underground economy. Okta documented Telegram vendors selling discounted access to Claude, Cursor, ChatGPT, and Gemini with 24/7 support and money-back guarantees. A service called "Poison Claude" (poison-claude.bitsender[.]top) resells access to Anthropic models including Opus 4.8, Opus 4.7, and Sonnet 4.6 at 5-15% of official per-token pricing; a misconfigured API endpoint revealed 881 total and 872 active users. Ecomagent.in operates similarly with ~970 users and claims to support Opus 4.8/5, Fable 5, Sonnet 5, and GPT-5.6 on flat monthly subscriptions from $19/month. A broader operation, Operation Bizarre Bazaar, mapped 35,000 attack sessions between December 2025 and January 2026 through the silver.inc marketplace, which resold access to 30+ LLM providers at 40-60% discounts and was attributed to a threat actor using the alias "Hecker."

Google's Mandiant team documented the UNC6426 threat cluster, which exploited the downstream consequences of the August 2025 s1ngularity npm supply chain attack. A malicious npm package executed a QUIETVAULT credential-stealing postinstall script that harvested GitHub Personal Access Tokens, npm tokens, SSH keys, cloud provider credentials, and AI tool configuration files. QUIETVAULT notably detected locally installed AI CLI tools — Claude Code, Google Gemini CLI, and Amazon Q Developer — and invoked them with permission-bypass flags (--dangerously-skip-permissions, --yolo, --trust-all-tools --no-interactive) to recursively scan the filesystem for additional sensitive material. This is the first documented instance of AI CLI tool weaponization within a supply chain postinstall script. The stolen PAT was used with NORDSTREAM (an open-source CI/CD extraction tool) to enumerate workflows and trigger GitHub Actions, exploiting an AWS OIDC trust policy lacking a scoped sub condition to achieve full AWS administrator access in under 72 hours, ultimately stealing 2,349 distinct secrets from 1,079 compromised repositories.

The Flare 2026 State of Enterprise Infostealer Exposure report provides broader context: 2.05 million infostealer logs exposed enterprise identity credentials in 2025 alone, with ~1.17 million logs containing both credentials and live session cookies enabling immediate MFA bypass. Enterprise identity exposure rose from ~6% of infections in early 2024 to ~16% in early 2026. Microsoft Entra ID appeared in 79% of enterprise identity logs. Despite a 20% year-over-year decline in total infostealer infections, enterprise identity exposure continued rising, indicating a structural shift toward targeted high-value enterprise credential theft.

Defensive recommendations include deploying Google's Device Bound Session Credentials (DBSC) in Chrome 145+ (which cryptographically binds session tokens to a specific device using TPM/Secure Enclave), implementing phishing-resistant FIDO2/WebAuthn MFA, continuous access evaluation, short-lived OAuth tokens with automatic rotation, scoped API keys per service, IP allowlisting for AI API endpoints, and proactive monitoring of organizational domains against leaked-log corpora. Okta noted that even passkeys do not prevent a stolen session token or API key from being replayed.