# Infostealer-Stolen AI Service Logins Expose 80,000+ Corporate Domains (Shadow AI to LLMjacking)

> SOCRadar's AI Identity Exposure Report 2026 maps over 1 million infostealer records tied to AI services across 80,000+ corporate domains, with ChatGPT/OpenAI accounts dominating. Stolen session cookies replay past MFA and stolen API keys enable LLMjacking; Anthropic separately reported infostealer-hijacked Claude sessions in late August 2026.

- **Published:** 2026-09-28T00:00:00Z
- **Last reviewed:** 2026-09-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2757
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-infostealer-ai-account-hijacking-tl-2026-2757.webp?v=282650cc (Threadlinqs threat intel: LLMjacking via Stolen AI Logins: Detection & IOCs (TL-2026-2757) — High severity, 11 IOCs, 9 detection rules.)
- **ID:** TL-2026-2757
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 11

## Description

SOCRadar (published as sponsored content on BleepingComputer on 2026-09-28) started from more than one million infostealer records tied to AI services across 80,000+ unique corporate domains, then narrowed the dataset to 482 major enterprises: about 68% billion-dollar organizations across 36 countries and 8 sectors, mostly in North America. In that subset SOCRadar found 5,434 stealer-log records tied to roughly 1,500 distinct corporate email addresses; 295 of the 482 companies surfaced within the last 90 days, and 358 of 482 had stolen ChatGPT/OpenAI credentials (about 90% of records). Technology/Internet services was the largest sector (144 companies, about 40% of records), with industrial, financial services, retail, healthcare and energy also exposed. Other AI/automation services seen in the logs include Zapier, Notion, Hugging Face, Replit, Lovable and ElevenLabs; Claude and Gemini had minimal presence in this dataset.

The exposure is not a vulnerability in any AI vendor. It is generic infostealer malware on employee endpoints copying saved passwords, browser cookies and application credentials, which are then sold or used. SOCRadar argues stolen AI sessions are more dangerous than stolen passwords because they combine conversation history, replayable session cookies that bypass MFA, standing OAuth grants for agents and automation, and billable API keys. Session tokens and API keys are sought precisely because they can be replayed to bypass credential-based authentication. Keys pasted into notes apps or workspace settings pages are harvested with everything else, then billed to the victim or resold (LLMjacking). Stolen automation-platform sessions could enable scheduled data exfiltration from trusted vendor IP space. SOCRadar also reports underground vendors selling discounted AI account access with money-back guarantees.

A corroborating first-party incident: around 2026-08-30/31 Anthropic warned Claude users that a bad actor was using common infostealer malware to steal Claude login sessions. Families named by press coverage of the warning were Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows and Atomic Stealer (AMOS) on a small number of Macs. Attackers replayed stolen sessions to drain usage limits and prepaid credits (and potentially trigger auto-reload purchases) without needing a password or 2FA code. Anthropic signed out compromised sessions, removed saved payment methods, refunded unauthorized charges and emailed affected users. One affected user reportedly traced the infection to pirated game software; Anthropic stated the malware is not tied to Claude itself and typically arrives via unofficial downloads or malicious apps.

Caveats: the 80,000+ figure and all breakdowns are SOCRadar vendor statistics from sponsored content and are unverified independently. The SOCRadar article names no malware family, actor, CVE or IOC; the malware-family attribution comes only from coverage of the separate Anthropic Claude incident, and the two datasets should not be assumed to be the same campaign. The full SOCRadar report could not be retrieved (HTTP 403).

## MITRE ATT&CK

- T1204.002 User Execution: Malicious File
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1552.001 Unsecured Credentials: Credentials In Files
- T1528 Steal Application Access Token
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1078.004 Valid Accounts: Cloud Accounts
- T1567 Exfiltration Over Web Service
- T1496.004 Resource Hijacking: Cloud Service Hijacking
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Non-Browser Process Reading Browser Credential and Cookie Stores — Credential Theft** (`TL-2026-2757-SPL-002`)

Detects a non-browser process opening multiple browser credential/cookie databases (Chromium Login Data, Web Data, Network\Cookies, Firefox cookies.sqlite, logins.json, key4.db). This is the core stealer behaviour that yields replayable ChatGPT/Claude session cookies that bypass MFA. Requires a SACL on the browser profile directories (Event 4663).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1539, T1555.003
- **Data sources:** windows_security
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4663 earliest=-24h
(Object_Name="*Login Data" OR Object_Name="*Web Data" OR Object_Name="*Network*Cookies" OR Object_Name="*cookies.sqlite" OR Object_Name="*logins.json" OR Object_Name="*key4.db")
NOT (Process_Name="*chrome.exe" OR Process_Name="*msedge.exe" OR Process_Name="*firefox.exe" OR Process_Name="*brave.exe" OR Process_Name="*opera.exe" OR Process_Name="*vivaldi.exe" OR Process_Name="*MsMpEng.exe")
| stats count dc(Object_Name) as stores values(Object_Name) as objects by host, Account_Name, Process_Name
| where stores>=2
| sort - stores
```

### Microsoft KQL

```kql
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where ObjectName matches regex @'(?i)(Login Data|Web Data|\\Network\\Cookies|cookies\.sqlite|logins\.json|key4\.db)$'
| where not(ProcessName has_any ('chrome.exe','msedge.exe','firefox.exe','brave.exe','opera.exe','vivaldi.exe','MsMpEng.exe'))
| summarize Stores = dcount(ObjectName), Objects = make_set(ObjectName, 10), FirstSeen = min(TimeGenerated), Events = count() by Computer, SubjectUserName, ProcessName
| where Stores >= 2
| order by Stores desc
```

### Sigma

```yaml
title: Non-Browser Process Accessing Browser Credential or Cookie Store
id: 8d14e6b2-5c93-4a7f-b6e0-2f9a1c3d5e42
status: experimental
description: Detects a process other than a web browser or AV engine opening browser credential and cookie databases. Infostealers (Vidar, LummaC2, StealC, RedLine, Acreed) do this to harvest saved passwords and session cookies for AI services. Requires object-access auditing (4663) on browser profile folders.
references:
    - https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/
    - https://attack.mitre.org/techniques/T1539/
author: Threadlinqs Team
date: 2026/09/28
tags:
    - attack.credential_access
    - attack.t1539
    - attack.t1555.003
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|endswith:
            - '\Login Data'
            - '\Web Data'
            - '\Network\Cookies'
            - '\cookies.sqlite'
            - '\logins.json'
            - '\key4.db'
    filter_browsers:
        ProcessName|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
            - '\MsMpEng.exe'
    condition: selection and not filter_browsers
falsepositives:
    - Backup or profile-migration tools
    - Enterprise browser-management agents
level: high
```

**Known false positives:**

- Backup, profile-migration or EDR/AV tools reading browser profile files
- Enterprise browser-management agents

**Tuning notes:** Requires SACL auditing (Read Data) on %LocalAppData%\Google\Chrome\User Data, Edge, Brave and Firefox profile dirs. Add your backup/EDR process names to the exclusion. Raise stores threshold to 3 in noisy estates.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Browser Credential/Cookie Database Staged to User-Writable Path (locked: unlock with TL Creds)
- Recursive Search for AI API Keys in Files, Notes and Config (locked: unlock with TL Creds)
- AI Service Session Replayed From New Country or Device — Session Cookie Reuse (locked: unlock with TL Creds)
- macOS Atomic Stealer (AMOS) Password Prompt and Keychain Access (locked: unlock with TL Creds)
- Stealer C2 and Dead-Drop Resolution — Community Infrastructure and Steam/Telegram/Epic Lookups (locked: unlock with TL Creds)
- Chromium Launched With Remote Debugging Port for Cookie Extraction (locked: unlock with TL Creds)
- Infostealer Loader via Fake AI Installer Lure or Pirated Software — Initial Execution (locked: unlock with TL Creds)
- AI Provider API Usage Spike or Off-Hours Access — LLMjacking (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking (BleepingComputer, sponsored by SOCRadar)](https://www.bleepingcomputer.com/news/security/80-000-plus-organizations-had-ai-logins-stolen-from-shadow-ai-to-llmjacking/)
- [SOCRadar AI Identity Exposure Report 2026](https://socradar.io/resources/report/ai-identity-exposure-report-2026.html)
- [New SOCRadar AI Identity Exposure Report Reveals 80,000+ Enterprises Had Employee AI Logins Stolen (The IT Nerd)](https://itnerd.blog/2026/09/28/new-socradar-ai-identity-exposure-report-reveals-80000-enterprises-had-employee-ai-logins-stolen-chatgpt-is-the-front-door/)
- [Anthropic warns infostealer malware is hijacking Claude sessions to drain usage (BleepingComputer)](https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/)
- [Anthropic Warns Claude Users of Infostealer Malware Infections (SecurityWeek)](https://www.securityweek.com/anthropic-warns-claude-users-of-infostealer-malware-infections/)
- [Anthropic locks out Claude users after infostealers hijack login sessions (Help Net Security)](https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/)
- [Infostealers are hijacking Claude accounts at users' expense (Malwarebytes)](https://www.malwarebytes.com/blog/news/2026/09/infostealers-are-hijacking-claude-accounts-at-users-expense)
- [Infostealers Are Hijacking Claude Sessions and Draining Subscriptions (Security Affairs)](https://securityaffairs.com/198166/ai/infostealers-are-hijacking-claude-sessions-and-draining-subscriptions.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2757