Skip to navigation

Threat reportMalwareTL-2026-2752

Infostealers Target Corporate AI Accounts, Sessions and API Keys (LLMjacking Risk)

highACTIVE

SOCRadar's AI Identity Exposure Report found 482 major enterprises with AI-platform credentials or sessions in 5,434 infostealer log records (295 of them in logs from the last 90 days), dominated by ChatGPT/OpenAI. Replayed session cookies and stolen API keys bypass passwords and MFA and enable data access and LLMjacking, where AI compute is consumed at the victim's expense or resold.

Key facts

IdentifiersTL-2026-2752
Also known asLLMjacking, AI identity exposure
SeverityHIGH
Affected productsOpenAI ChatGPT / OpenAI API (sessions, NextAuth.js JWEs, API keys); Anthropic Claude (browser sessions); Google Gemini and Google account tokens (Gemini API keys); Cursor Cursor (sessions); Hugging Face Hugging Face accounts; Zapier Zapier automation sessions (OAuth grants into CRM, email, file storage); Notion Notion workspace sessions; Replit Replit accounts and 2 more
MalwareAcreed, Atomic Stealer (AMOS), Lumma Stealer - S1213, RedLine, Remus, Stealc, Vidar, telegram
ToolsCamoufox, SeleniumBase
MITRE ATT&CK techniquesT1005 Data from Local System, T1078 Valid Accounts, T1078.004 Cloud Accounts, T1090 Proxy, T1204.002 Malicious File, T1213 Data from Information Repositories, T1496.004 Cloud Service Hijacking, T1528 Steal Application Access Token, T1539 Steal Web Session Cookie, T1550.004 Web Session Cookie, T1552.001 Credentials In Files, T1555.003 Credentials from Web Browsers and 1 more in the attack flow
MotivationFINANCIAL
Target sectorstechnology, internet services, enterprise
Target regionsNorth America, Global
Detection rules9 (1 shown free)
Sources15 cited sources

Detection coverage

As of 2026-09-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2752 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Stolen Session Replay — One Okta Session ID Used from Multiple Client Fingerprints, Networks or Proxies

Detects a single Okta session (authenticationContext.externalSessionId) used for app SSO from more than one OS/browser fingerprint, or from multiple ASNs and countries, or from a flagged proxy plus a network change. Okta observed replay tooling built on anti-detect browsers (Camoufox) and SeleniumBase that loads stolen sessionStorage/localStorage data and routes through proxies to defeat impossible-travel checks. A replayed cookie produces authenticated access with no login event, bypassing passwords and MFA.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1550.004, T1539, T1090
  • Data sources: okta_system_log, splunk_OktaIM2:log, okta_identity_threat_protection
  • Severity: high
  • Confidence: medium

Splunk SPL

index=okta sourcetype="OktaIM2:log" eventType="user.authentication.sso" outcome.result=SUCCESS earliest=-24h
| rename authenticationContext.externalSessionId as session_id, actor.alternateId as user, client.ipAddress as src_ip, client.userAgent.os as ua_os, client.userAgent.browser as ua_browser, securityContext.asNumber as asn, client.geographicalContext.country as country, securityContext.isProxy as is_proxy
| where isnotnull(session_id) AND session_id!="unknown"
```one session should map to one device: compare OS+browser, ASN and country per session id```
| eval client_fp=coalesce(ua_os, "?")."|".coalesce(ua_browser, "?")
| stats dc(client_fp) as fp_count dc(asn) as asn_count dc(country) as country_count dc(src_ip) as ip_count max(eval(if(lower(is_proxy)="true", 1, 0))) as proxy_seen values(client_fp) as fingerprints values(country) as countries values(asn) as asns values(src_ip) as src_ips min(_time) as first_seen max(_time) as last_seen by user, session_id
| where fp_count>1 OR (asn_count>1 AND country_count>1) OR (proxy_seen=1 AND asn_count>1)
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen user session_id fingerprints countries asns src_ips proxy_seen

Microsoft KQL

let lookback = 1d;
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(lookback)
| where ResultType == "0" and isnotempty(SessionId)
| extend Country = tostring(LocationDetails.countryOrRegion), DeviceOS = tostring(DeviceDetail.operatingSystem)
| summarize OsCount = dcount(DeviceOS), AsnCount = dcount(AutonomousSystemNumber), CountryCount = dcount(Country), IpCount = dcount(IPAddress), OsSet = make_set(DeviceOS, 10), AsnSet = make_set(AutonomousSystemNumber, 10), CountrySet = make_set(Country, 10), IpSet = make_set(IPAddress, 10), Apps = make_set(AppDisplayName, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserPrincipalName, SessionId
| where OsCount > 1 or (AsnCount > 1 and CountryCount > 1)
| order by LastSeen desc

Sigma

title: Okta Successful SSO Event with Session Identifier
id: 3a8e5f19-b7c4-4d02-9e6a-f1d8c2b04e57
name: okta_sso_success_with_session
status: experimental
description: Base rule matching successful Okta application SSO events. Used by the session-replay correlation rule below.
author: Threadlinqs Team
date: 2026-09-28
logsource:
    product: okta
    service: okta
detection:
    selection:
        eventtype: 'user.authentication.sso'
        outcome.result: 'SUCCESS'
    condition: selection
level: informational
---
title: Okta Session Identifier Replayed from Multiple Client Operating Systems
id: 92c4e1d6-5a3b-4f78-8c2d-b0e7a9f16d43
status: experimental
description: Detects one Okta session identifier used for application SSO from two or more client operating systems within 24 hours, the signature of a stolen session cookie or token replayed through an anti-detect browser (Camoufox) and SeleniumBase automation. Replay bypasses passwords and MFA and often uses proxies to defeat impossible-travel checks, so device-fingerprint divergence is used instead of geography.
references:
    - https://www.okta.com/blog/threat-intelligence/signing_in_without_actually_signing_in/
    - https://labs.cloudsecurityalliance.org/research/csa-research-note-infostealer-ai-token-replay-20260911-csa-s/
author: Threadlinqs Team
date: 2026-09-28
tags:
    - attack.lateral-movement
    - attack.t1550.004
    - attack.credential-access
    - attack.t1539
    - attack.command-and-control
    - attack.t1090
correlation:
    type: value_count
    rules:
        - okta_sso_success_with_session
    group-by:
        - authenticationContext.externalSessionId
    timespan: 24h
    condition:
        gte: 2
        field: client.userAgent.os
falsepositives:
    - Users who sign in on one device and open the same SSO session through a remote-desktop or VDI client with a different OS
level: high

Known false positives:

  • Users reaching one SSO session through VDI or remote-desktop hosts with a different OS
  • Mobile users roaming between Wi-Fi and cellular, which can change ASN and country without changing the OS/browser fingerprint

Tuning notes: Start with the fingerprint-divergence branch alone (highest fidelity), then enable the ASN+country and proxy branches. Camoufox can spoof OS and browser, so keep the network branches enabled and add a check for a session that has no session-start or MFA event in-window. Suppress corporate VPN/egress ASNs and VDI subnets. Pair with Okta Universal Logout to kill the session automatically on a hit.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Browser Credential and Session-Cookie Stores Staged by Non-Browser Process — Stealer Harvest Pattern · unlock with TL Creds
  • LLMjacking — New Identity Invoking AWS Bedrock or Tampering with Model Access and Invocation Logging · unlock with TL Creds
  • Entra ID Session Replay — Same Session ID from Multiple Device OS Values, or from Multiple ASNs and Countries · unlock with TL Creds
  • macOS Browser Safe Storage Keychain Extraction and Fake Password Prompt — Atomic Stealer (AMOS) Pattern · unlock with TL Creds
  • Consent Granted to AI or Automation Application (Zapier, Notion, ChatGPT, Claude, Cursor) — Stolen-Session OAuth Persistence · unlock with TL Creds
  • DNS or Network Contact with Poison Claude Gray-Market Reseller and Community-Related Infostealer Infrastructure · unlock with TL Creds
  • Infostealer Lure Execution — Unsigned Binary from Download/Archive Path with Cracked-Software or Fake AI-Installer Naming · unlock with TL Creds
  • AI Provider API-Key Hunting in Files — Secret Scan for OpenAI, Anthropic, Gemini, Groq, OpenRouter and Hugging Face Keys · unlock with TL Creds

Indicators of compromise

As of 2026-09-28, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-2752.

Sample indicators (2 of 16)

  • Domain: poison-claude[.]bitsender[.]top
  • Domain: api[.]claudeopus[.]shop

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

16 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

SOCRadar's AI Identity Exposure Report 2026 (published 2026-09-28, covered by Security Affairs and BleepingComputer) mapped more than one million infostealer records tied to AI services across 80,000+ corporate domains, then narrowed the analysis to 482 major, established enterprises (about 68% billion-dollar organizations, 36 countries, eight sectors, concentrated in North America). Those 482 companies map to 5,434 stealer-log records and roughly 1,500 distinct corporate email addresses; 295 of the 482 surfaced in logs from the previous 90 days. Technology and internet-services firms are the largest group (144 companies, 40% of records). A captured ChatGPT/OpenAI session appears for 358 of 482 companies (74.3%) and those companies carry roughly 90% of all records. Zapier, Notion, Hugging Face, Replit, Lovable and ElevenLabs trail far behind, and Claude and Gemini rank low, which SOCRadar reads as a shadow-AI adoption skew (employees signing up with work email on personal devices) rather than a verdict on any vendor's security. The article cited by the hunt also lists Cursor among the exposed services.

The attack chain is commodity: general-purpose infostealer malware, typically delivered through phishing, fake installers, pirated or trojanized software and malicious extensions, harvests the whole browser profile of an infected machine, including saved passwords, live session cookies, JWTs and any API keys pasted into notes apps, configuration files or workspace settings. Session tokens can be replayed to bypass credential-based authentication, so rotating the password alone leaves the intruder signed in ('a stolen cookie is a live session'). Conversation histories are effectively corporate data stores, because employees paste source code, customer data, contracts and unreleased plans into prompts. Agent and automation platforms such as Zapier can additionally hold standing OAuth authorization into CRM, email and file storage. The source describes LLMjacking as attackers stealing keys from notes, configuration files or workspace settings and using them to run AI workloads at the victim's expense, or reselling the access.

Okta Threat Intelligence ('Signing in without actually signing in', 2026-09-09) independently analyzed a 7 GB stealer-log dump posted to a Telegram channel on 2026-08-02: 5,871 folders, one per infected machine, across 162 countries. It contained 44,791 unique JWTs (555 tied to AI services, 17.7% with plaintext PII), 2,937 JWEs (mostly OpenAI NextAuth.js), 1,843 unexpired JWTs/JWEs on the dump date, and thousands of still-valid provider tokens (Google 9,213 unexpired of 9,829; Microsoft 1,763 of 2,491; Anthropic 164 of 561 across 404 machines; Amazon 254 of 349; Gamma 131 of 160; Notion 79 of 90; Character.ai 31 of 38; Cursor 16 of 32; Poe.com 25 of 28; Pika AI 17 of 20). TruffleHog found 24 still-valid API keys for Google Gemini, OpenAI, Groq and OpenRouter. Okta observed replay tooling built around anti-detect browsers (Camoufox) and SeleniumBase that loads sessionStorage/localStorage data from file and configures proxies to defeat impossible-travel detection, and noted it saw no stolen Okta sessions in the dump. The single stealer family Okta names is Remus, seen on one Windows 11 machine in Israel after a trojanized Hearts of Iron IV download.

The risk is already operational. On 2026-08-30 Anthropic emailed affected users that a bad actor was using common infostealer malware to steal Claude login sessions and consume their usage; families named were Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows and Atomic Stealer (AMOS) on a small number of Macs. Anthropic signed users out, removed saved payment methods and refunded unauthorized charges, and stated its platform was not breached and that signing out does not remove the malware. Okta also reported Telegram vendors selling discounted Claude, Cursor, ChatGPT and Gemini access with 24x7 support and money-back guarantees, including a service branded Poison Claude that advertises Opus 4.8/4.7/4.6 and Sonnet 4.6 at 5-15% of official per-token prices. Poison Claude's pricing is attributed to pooled fraudulent cloud accounts with free promotional credits (for example AWS Bedrock new-user credits) rather than to stolen sessions, and because it is a gateway proxy its operator sees every customer prompt; it is documented here as adjacent gray-market context, not as proven consumer of the SOCRadar or Okta datasets.

Limits of the evidence: neither the SOCRadar article nor Okta attributes the logs to a single stealer family or threat actor, no IOCs are published for the dump itself, and SOCRadar's own figures are exposure counts rather than confirmed account takeovers. Lumma and Vidar are named by Anthropic for the Claude campaign and by secondary reporting as capable of this collection; they are not established as the source of the SOCRadar or Okta datasets. The Cloud Security Alliance issued a v1.1 revision of its research note on 2026-09-11 correcting scale-inflation errors in early coverage, so secondary figures should be checked against the primary SOCRadar and Okta numbers used here.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Initial Access

T1078 Valid Accounts; T1078.004 Cloud Accounts

Command and Control

T1090 Proxy

Execution

T1204.002 Malicious File

Impact

T1496.004 Cloud Service Hijacking

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers

lateral-movement

T1550.004 Web Session Cookie

Resource Development

T1650 Acquire Access

Remediation

Immediate actions

  • Treat any corporate AI-account hit in stealer-log intelligence as an endpoint compromise, not a password reset: isolate and reimage or clean the infected device before re-issuing credentials
  • Revoke active sessions and force sign-out on affected AI/SaaS accounts (signing out stops stolen sessions but does not remove the malware); use Universal Logout or equivalent where available
  • Rotate all AI provider API keys found on or reachable from infected endpoints (OpenAI, Anthropic, Google Gemini, Groq, OpenRouter, Hugging Face) and review billing and usage for anomalies
  • Review AI-platform and connected SaaS audit logs for logins or API calls from unfamiliar geographies, device fingerprints or off-hours activity
  • Check Zapier, Notion and other agent/automation platforms for unexpected OAuth grants, scheduled jobs and connected-system access

Workarounds

  • No vendor patch applies (account and session exposure, not a product flaw); remove saved payment methods and disable API keys that cannot be rotated immediately
  • Where a provider cannot bind sessions to devices, shorten session lifetime and require re-authentication for sensitive actions

Longer-term hardening

  • Put AI platforms behind SSO with short-lived sessions and refresh-token rotation (OAuth 2.0/OIDC short-lived access tokens)
  • Adopt Device-Bound Session Credentials where supported and deploy session-token re-use detection (for example Okta Identity Threat Protection session protection)
  • Set usage caps and IP allowlists on API keys, scope keys narrowly, and keep them in a secrets manager rather than plaintext notes, config files or environment variables
  • Inventory shadow AI accounts (work email on personal devices) using stealer-log exposure monitoring before attackers do
  • Move to phishing-resistant authentication such as passkeys and add anomaly and cross-device session-reuse monitoring
  • Harden endpoints against commodity stealers: block unofficial and pirated software, restrict browser extensions, and deploy EDR with infostealer behavioral detection

Affected and fixed versions

  • OpenAI — ChatGPT / OpenAI API (sessions, NextAuth.js JWEs, API keys)
  • Anthropic — Claude (browser sessions)
  • Google — Gemini and Google account tokens (Gemini API keys)
  • Cursor — Cursor (sessions)
  • Hugging Face — Hugging Face accounts
  • Zapier — Zapier automation sessions (OAuth grants into CRM, email, file storage)
  • Notion — Notion workspace sessions
  • Replit — Replit accounts
  • Lovable — Lovable accounts
  • ElevenLabs — ElevenLabs accounts

Timeline

  • Remus, a 64-bit stealer reported as a Lumma successor that emphasizes cookie and session-token theft, is first commercially promoted on underground forums (month-level precision; the only stealer family Okta names in its later dump analysis)
  • A 7 GB infostealer log dump (5,871 infected machines across 162 countries, containing thousands of unexpired AI and SaaS session tokens) is released on a Telegram channel; Okta later analyzes it
  • Adaptive Security publishes analysis of the Poison Claude gray-market reseller uncovered by Okta researchers, which sells Claude access at 5-15% of official prices via pooled fraudulent cloud accounts and sees every customer prompt
  • Anthropic emails affected users that infostealer malware (Vidar, LummaC2, StealC, RedLine, Acreed on Windows; AMOS on some Macs) is stealing Claude login sessions to consume their usage; it signs users out, removes saved payment methods and refunds unauthorized charges
  • Help Net Security reports Anthropic's remediation and guidance, including that signing out stops stolen sessions but does not remove the malware and that one victim traced infection to a pirated game
  • Okta Threat Intelligence publishes 'Signing in without actually signing in': 44,791 unique JWTs, 2,937 JWEs, 1,843 unexpired tokens and 24 still-valid AI API keys found in the Telegram dump, plus Camoufox/SeleniumBase replay tooling
  • Cloud Security Alliance research note on AI token replay is revised (v1.1) to correct scale-inflation errors in early coverage
  • SOCRadar publishes its AI Identity Exposure Report 2026 (482 enterprises, 5,434 stealer-log records, 295 active in the last 90 days, ChatGPT/OpenAI exposed at 358 companies); Security Affairs and BleepingComputer cover it

Sources cited

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 15 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats