Infostealer-Stolen AI Service Logins Expose 80,000+ Corporate Domains (Shadow AI to LLMjacking)

Key facts

Detection coverage

As of 2026-09-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2757 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Non-Browser Process Reading Browser Credential and Cookie Stores — Credential Theft

Detects a non-browser process opening multiple browser credential/cookie databases (Chromium Login Data, Web Data, Network\Cookies, Firefox cookies.sqlite, logins.json, key4.db). This is the core stealer behaviour that yields replayable ChatGPT/Claude session cookies that bypass MFA. Requires a SACL on the browser profile directories (Event 4663).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1539, T1555.003
• Data sources: windows_security
• Severity: high
• Confidence: medium

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4663 earliest=-24h
(Object_Name="*Login Data" OR Object_Name="*Web Data" OR Object_Name="*Network*Cookies" OR Object_Name="*cookies.sqlite" OR Object_Name="*logins.json" OR Object_Name="*key4.db")
NOT (Process_Name="*chrome.exe" OR Process_Name="*msedge.exe" OR Process_Name="*firefox.exe" OR Process_Name="*brave.exe" OR Process_Name="*opera.exe" OR Process_Name="*vivaldi.exe" OR Process_Name="*MsMpEng.exe")
| stats count dc(Object_Name) as stores values(Object_Name) as objects by host, Account_Name, Process_Name
| where stores>=2
| sort - stores

Microsoft KQL

SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where ObjectName matches regex @'(?i)(Login Data|Web Data|\\Network\\Cookies|cookies\.sqlite|logins\.json|key4\.db)$'
| where not(ProcessName has_any ('chrome.exe','msedge.exe','firefox.exe','brave.exe','opera.exe','vivaldi.exe','MsMpEng.exe'))
| summarize Stores = dcount(ObjectName), Objects = make_set(ObjectName, 10), FirstSeen = min(TimeGenerated), Events = count() by Computer, SubjectUserName, ProcessName
| where Stores >= 2
| order by Stores desc

Sigma

title: Non-Browser Process Accessing Browser Credential or Cookie Store
id: 8d14e6b2-5c93-4a7f-b6e0-2f9a1c3d5e42
status: experimental
description: Detects a process other than a web browser or AV engine opening browser credential and cookie databases. Infostealers (Vidar, LummaC2, StealC, RedLine, Acreed) do this to harvest saved passwords and session cookies for AI services. Requires object-access auditing (4663) on browser profile folders.
references:
    - https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/
    - https://attack.mitre.org/techniques/T1539/
author: Threadlinqs Team
date: 2026/09/28
tags:
    - attack.credential_access
    - attack.t1539
    - attack.t1555.003
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|endswith:
            - '\Login Data'
            - '\Web Data'
            - '\Network\Cookies'
            - '\cookies.sqlite'
            - '\logins.json'
            - '\key4.db'
    filter_browsers:
        ProcessName|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
            - '\MsMpEng.exe'
    condition: selection and not filter_browsers
falsepositives:
    - Backup or profile-migration tools
    - Enterprise browser-management agents
level: high

Known false positives:

• Backup, profile-migration or EDR/AV tools reading browser profile files
• Enterprise browser-management agents

Tuning notes: Requires SACL auditing (Read Data) on %LocalAppData%\Google\Chrome\User Data, Edge, Brave and Firefox profile dirs. Add your backup/EDR process names to the exclusion. Raise stores threshold to 3 in noisy estates.

• 🔒 Browser Credential/Cookie Database Staged to User-Writable Path · unlock with TL Creds
• 🔒 Recursive Search for AI API Keys in Files, Notes and Config · unlock with TL Creds
• 🔒 AI Service Session Replayed From New Country or Device — Session Cookie Reuse · unlock with TL Creds
• 🔒 macOS Atomic Stealer (AMOS) Password Prompt and Keychain Access · unlock with TL Creds
• 🔒 Stealer C2 and Dead-Drop Resolution — Community Infrastructure and Steam/Telegram/Epic Lookups · unlock with TL Creds
• 🔒 Chromium Launched With Remote Debugging Port for Cookie Extraction · unlock with TL Creds
• 🔒 Infostealer Loader via Fake AI Installer Lure or Pirated Software — Initial Execution · unlock with TL Creds
• 🔒 AI Provider API Usage Spike or Off-Hours Access — LLMjacking · unlock with TL Creds

Indicators of compromise

As of 2026-09-28, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-2757.

Technical analysis

SOCRadar (published as sponsored content on BleepingComputer on 2026-09-28) started from more than one million infostealer records tied to AI services across 80,000+ unique corporate domains, then narrowed the dataset to 482 major enterprises: about 68% billion-dollar organizations across 36 countries and 8 sectors, mostly in North America. In that subset SOCRadar found 5,434 stealer-log records tied to roughly 1,500 distinct corporate email addresses; 295 of the 482 companies surfaced within the last 90 days, and 358 of 482 had stolen ChatGPT/OpenAI credentials (about 90% of records). Technology/Internet services was the largest sector (144 companies, about 40% of records), with industrial, financial services, retail, healthcare and energy also exposed. Other AI/automation services seen in the logs include Zapier, Notion, Hugging Face, Replit, Lovable and ElevenLabs; Claude and Gemini had minimal presence in this dataset.

The exposure is not a vulnerability in any AI vendor. It is generic infostealer malware on employee endpoints copying saved passwords, browser cookies and application credentials, which are then sold or used. SOCRadar argues stolen AI sessions are more dangerous than stolen passwords because they combine conversation history, replayable session cookies that bypass MFA, standing OAuth grants for agents and automation, and billable API keys. Session tokens and API keys are sought precisely because they can be replayed to bypass credential-based authentication. Keys pasted into notes apps or workspace settings pages are harvested with everything else, then billed to the victim or resold (LLMjacking). Stolen automation-platform sessions could enable scheduled data exfiltration from trusted vendor IP space. SOCRadar also reports underground vendors selling discounted AI account access with money-back guarantees.

A corroborating first-party incident: around 2026-08-30/31 Anthropic warned Claude users that a bad actor was using common infostealer malware to steal Claude login sessions. Families named by press coverage of the warning were Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows and Atomic Stealer (AMOS) on a small number of Macs. Attackers replayed stolen sessions to drain usage limits and prepaid credits (and potentially trigger auto-reload purchases) without needing a password or 2FA code. Anthropic signed out compromised sessions, removed saved payment methods, refunded unauthorized charges and emailed affected users. One affected user reportedly traced the infection to pirated game software; Anthropic stated the malware is not tied to Claude itself and typically arrives via unofficial downloads or malicious apps.

Caveats: the 80,000+ figure and all breakdowns are SOCRadar vendor statistics from sponsored content and are unverified independently. The SOCRadar article names no malware family, actor, CVE or IOC; the malware-family attribution comes only from coverage of the separate Anthropic Claude incident, and the two datasets should not be assumed to be the same campaign. The full SOCRadar report could not be retrieved (HTTP 403).

MITRE ATT&CK techniques by tactic:

Initial Access

T1078.004 Valid Accounts: Cloud Accounts

Execution

T1204.002 User Execution: Malicious File

Impact

T1496.004 Resource Hijacking: Cloud Service Hijacking; T1657 Financial Theft

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Lateral Movement

T1550.004 Use Alternate Authentication Material: Web Session Cookie

Exfiltration

T1567 Exfiltration Over Web Service

Remediation

Immediate actions

• Treat any employee appearing in a stealer log as an endpoint incident, not just a password reset: isolate, scan and remediate the host before restoring access
• Revoke all active sessions and OAuth grants for affected AI accounts and rotate any API keys stored in browsers, notes apps or workspace settings
• Review AI provider billing and usage for unexpected spend, and remove saved payment methods until endpoints are clean

Workarounds

• Where SSO is unavailable, require re-authentication for sensitive AI account actions and disable payment auto-reload
• Use SOCRadar's free AI Exposure Checker or equivalent breach-monitoring to identify exposed corporate domains

Longer-term hardening

• Enforce SSO (OAuth 2.0/OIDC) for AI services with short-lived sessions and refresh-token rotation
• Scope, cap and rotate API keys; alert on usage from unfamiliar ASNs or at odd hours
• Detect session-token reuse where a session changes country or device fingerprint mid-life
• Discover pre-existing shadow AI accounts before enforcing policy
• Block unofficial software downloads and pirated software on managed endpoints; deploy EDR with infostealer behavioral detection

Affected and fixed versions

• OpenAI — ChatGPT / OpenAI accounts
  Vulnerable versions: Accounts with credentials or sessions present in infostealer logs
• Anthropic — Claude accounts
  Vulnerable versions: Sessions stolen from infostealer-infected endpoints (Aug 2026)
  Fixed in: Compromised sessions signed out by Anthropic
• Zapier — Zapier accounts
  Vulnerable versions: Accounts present in stealer logs
• Notion — Notion accounts
  Vulnerable versions: Accounts present in stealer logs
• Hugging Face — Hugging Face accounts
  Vulnerable versions: Accounts present in stealer logs
• Replit — Replit accounts
  Vulnerable versions: Accounts present in stealer logs
• Lovable — Lovable accounts
  Vulnerable versions: Accounts present in stealer logs
• ElevenLabs — ElevenLabs accounts
  Vulnerable versions: Accounts present in stealer logs

Timeline

• 2026-08-30 Anthropic signs out compromised sessions, removes saved payment methods from affected accounts, refunds unauthorized charges and emails affected users.
• 2026-08-30 Anthropic warns some Claude users that a bad actor is using common infostealer malware to steal Claude login sessions and drain usage; BleepingComputer reports the warning.
• 2026-08-31 SecurityWeek and Help Net Security coverage names Vidar, Lumma, StealC, RedLine and Acreed (Windows) and Atomic Stealer (macOS) as the infostealer families involved.
• 2026-09-01 Malwarebytes publishes guidance: attackers consume usage allowances and prepaid credits and may trigger auto-reload; victims should scan devices before logging back in.
• 2026-09-28 BleepingComputer publishes the SOCRadar-sponsored article 'From Shadow AI to LLMjacking' summarizing the findings and defensive recommendations.
• 2026-09-28 SOCRadar publishes its AI Identity Exposure Report 2026: 1M+ infostealer records tied to AI services across 80,000+ corporate domains; 482 enterprises analyzed.

Sources cited

• SOCRadar AI Identity Exposure Report 2026 socradar.io · Research · 2026-09-28
• Infostealers are hijacking Claude accounts at users' expense (Malwarebytes) malwarebytes.com · Blog · 2026-09-01
• 80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking (BleepingComputer, sponsored by SOCRadar) BleepingComputer · News · 2026-09-28
• New SOCRadar AI Identity Exposure Report Reveals 80,000+ Enterprises Had Employee AI Logins Stolen (The IT Nerd) itnerd.blog · News · 2026-09-28
• Anthropic warns infostealer malware is hijacking Claude sessions to drain usage (BleepingComputer) BleepingComputer · News · 2026-08-30
• Anthropic Warns Claude Users of Infostealer Malware Infections (SecurityWeek) SecurityWeek · News · 2026-08-31
• Anthropic locks out Claude users after infostealers hijack login sessions (Help Net Security) Help Net Security · News · 2026-08-31
• Infostealers Are Hijacking Claude Sessions and Draining Subscriptions (Security Affairs) securityaffairs.com · News · 2026-08-31

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• Infostealers Target Corporate AI Accounts, Sessions and API Keys (LLMjacking Risk) Previous report
• Remcos RAT phishing campaign disguised as project material purchase requests exploits CVE-2017-0199 against Korean companies Next report