# Infostealer Logs Expose Replayable AI Session Tokens and API Keys Enabling MFA Bypass

> Okta analysis of a 7 GB infostealer dump published to Telegram on August 2, 2026 spanning 5,871 infected machines across 162 countries found 44,791 unique JWTs including 555 likely tied to AI service authentication, 24 still-valid API keys for Google Gemini, OpenAI, Groq, and OpenRouter, and plaintext PII in 17.7% of tokens. Stolen sessions replayed against Google, Anthropic, OpenAI, and other LLM platforms bypass username/password and MFA, enabling LLMjacking, resource theft, and extortion. Mandiant documented one incident where an exposed GitHub PAT led to unauthorized AI infrastructure deployment in a victim's cloud environment via the UNC6426 threat cluster abusing an npm supply chain attack.

- **Published:** 2026-09-09T00:00:00Z
- **Last reviewed:** 2026-09-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2416
- **ID:** TL-2026-2416
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In early August 2026, a 7 GB archive of infostealer logs was published to a Telegram channel, exposing data from 5,871 infected machines across 162 countries. Okta's threat intelligence team analyzed the dump and identified 44,791 unique JSON Web Tokens (JWTs), of which 555 were likely tied to AI service authentication, and 2,937 JWE structures (encrypted JWTs set by OpenAI via NextAuth.js). Notably, 1,843 JWTs and JWEs remained unexpired on the release date, and 17.7% of all tokens contained plaintext personally identifiable information (PII) including names, phone numbers, and email addresses that never expire or disappear.

Using automated scanning tools including TruffleHog, Okta validated 24 still-active API keys for AI services across Google Gemini, OpenAI, Groq, and OpenRouter. These API keys enable LLMjacking — unauthorized use of cloud-hosted LLM inference capacity — where attackers route requests through subscription accounts they have not paid for, running up compute bills charged to the original account holder. Financial exposure can reach $46,000 per day per victim for AWS Bedrock deployments, and over $100,000 per day for frontier model access. The attack chain exploits a fundamental session security gap: a valid session token issued after successful MFA is stored in the browser and can be exfiltrated by infostealer malware, then replayed from a different device with no additional authentication.

Two infostealer families were identified as primary harvesters: Lumma Stealer (LummaC2) and Vidar. Both employ advanced browser data extraction techniques, including defeating Google Chrome v127+ App-Bound Encryption (ABE) through process injection — Lumma uses QueueUserAPC() to inject into chrome.exe and call Chrome's IElevator COM interface from within the trusted process, while Vidar uses NtCreateProcessEx to fork the browser's memory and APC injection to call CryptUnprotectMemory. These techniques allow extraction of HttpOnly and Secure-flagged cookies with full session validity. Delivery mechanisms include phishing campaigns, malvertising (fake Notepad++ and Chrome update ads), ClickFix fake CAPTCHA lures that execute PowerShell commands, EtherHiding via Binance Smart Chain smart contracts for malware hosting, and cracked software downloads.

The stolen credentials feed an established underground economy. Okta documented Telegram vendors selling discounted access to Claude, Cursor, ChatGPT, and Gemini with 24/7 support and money-back guarantees. A service called "Poison Claude" (poison-claude.bitsender[.]top) resells access to Anthropic models including Opus 4.8, Opus 4.7, and Sonnet 4.6 at 5-15% of official per-token pricing; a misconfigured API endpoint revealed 881 total and 872 active users. Ecomagent.in operates similarly with ~970 users and claims to support Opus 4.8/5, Fable 5, Sonnet 5, and GPT-5.6 on flat monthly subscriptions from $19/month. A broader operation, Operation Bizarre Bazaar, mapped 35,000 attack sessions between December 2025 and January 2026 through the silver.inc marketplace, which resold access to 30+ LLM providers at 40-60% discounts and was attributed to a threat actor using the alias "Hecker."

Google's Mandiant team documented the UNC6426 threat cluster, which exploited the downstream consequences of the August 2025 s1ngularity npm supply chain attack. A malicious npm package executed a QUIETVAULT credential-stealing postinstall script that harvested GitHub Personal Access Tokens, npm tokens, SSH keys, cloud provider credentials, and AI tool configuration files. QUIETVAULT notably detected locally installed AI CLI tools — Claude Code, Google Gemini CLI, and Amazon Q Developer — and invoked them with permission-bypass flags (--dangerously-skip-permissions, --yolo, --trust-all-tools --no-interactive) to recursively scan the filesystem for additional sensitive material. This is the first documented instance of AI CLI tool weaponization within a supply chain postinstall script. The stolen PAT was used with NORDSTREAM (an open-source CI/CD extraction tool) to enumerate workflows and trigger GitHub Actions, exploiting an AWS OIDC trust policy lacking a scoped sub condition to achieve full AWS administrator access in under 72 hours, ultimately stealing 2,349 distinct secrets from 1,079 compromised repositories.

The Flare 2026 State of Enterprise Infostealer Exposure report provides broader context: 2.05 million infostealer logs exposed enterprise identity credentials in 2025 alone, with ~1.17 million logs containing both credentials and live session cookies enabling immediate MFA bypass. Enterprise identity exposure rose from ~6% of infections in early 2024 to ~16% in early 2026. Microsoft Entra ID appeared in 79% of enterprise identity logs. Despite a 20% year-over-year decline in total infostealer infections, enterprise identity exposure continued rising, indicating a structural shift toward targeted high-value enterprise credential theft.

Defensive recommendations include deploying Google's Device Bound Session Credentials (DBSC) in Chrome 145+ (which cryptographically binds session tokens to a specific device using TPM/Secure Enclave), implementing phishing-resistant FIDO2/WebAuthn MFA, continuous access evaluation, short-lived OAuth tokens with automatic rotation, scoped API keys per service, IP allowlisting for AI API endpoints, and proactive monitoring of organizational domains against leaked-log corpora. Okta noted that even passkeys do not prevent a stolen session token or API key from being replayed.

## MITRE ATT&CK

- T1566 Phishing
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1496 Resource Hijacking
- T1555 Credentials from Password Stores
- T1055 Process Injection
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1195 Supply Chain Compromise
- T1053 Scheduled Task/Job
- T1588 Obtain Capabilities
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1583 Acquire Infrastructure

## Sources

- [The Hacker News: Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA](https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html)
- [Okta: Free Tokens for Sale — How Fake Signups Drive AI Fraud](http://www.okta.com/blog/threat-intelligence/free_tokens_for_sale/)
- [IT Pro: Cyber Criminals Selling Discounted AI Tokens on Underground Forums](http://www.itpro.com/)
- [CSA Research Note: OIDC Trust Chain Abuse Cloud Takeover (March 2026)](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/CSA_research_note_oidc_trust_chain_abuse_cloud_takeover_20260311-csa-styl.pdf)
- [Sysdig: LLMJacking — From Emerging Threat to Black Market Reality](https://www.sysdig.com/blog/llmjacking-from-emerging-threat-to-black-market-reality/)
- [Unit 42 (Palo Alto): Token Jacking — Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/)
- [Flare 2026 State of Enterprise Infostealer Exposure Report](http://flare.io/)
- [Microsoft Security Blog: Luma Stealer (May 2025)](http://www.microsoft.com/en-us/security/blog/2025/05/21/luma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)
- [SecurBlink: Infostealer Malware Hijacks Claude Sessions — Anthropic Warns Users](https://www.securblink.com/threat-feeds/infostealer-malware-hijacks-claude-sessions-anthropic-warns-users/)
- [Help Net Security: Discounted Claude Access Bought on the Gray Market May Expose Every Prompt You Send](https://www.helpnetsecurity.com/2026/08/06/ai-model-access-fraud-gray-market/)
- [CSA Research Note: LLMJacking Evolves — Stolen AI Compute as Attack Infrastructure (Jun 2026)](https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-offensive-ai-tooling-20260618-c/)
- [Google Chrome for Developers: Device Bound Session Credentials (DBSC)](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials)
- [Lunar Cyber: The Token Haystack — Parsing and Verifying Exposed Tokens in Stealer Logs](https://lunarcyber.com/blog/the-token-haystack-parsing-and-verifying-exposed-tokens-in-stealer-logs/)
- [Fortinet FortiGuard Labs: Someone Else Is Using Your AI](https://www.fortinet.com/blog/threat-research/someone-else-is-using-your-ai)
- [Cloud Security Alliance: LLMJacking — AI Model Hijacking Reaches Black Market Scale (Mar 2026)](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/CSA_research_note_llmjacking_black_market_ai_model_hijacking_20260315-csa-styl.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2416