Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
A massive dump of stolen infostealer logs, containing 5,871 infected machines across 162 countries, has exposed a wealth of AI-related credentials and API keys. The data includes session tokens, JWTs, and JWEs for services like Google, Anthropic, OpenAI, and others, allowing attackers to bypass MFA and gain unauthorized access to AI services. Cybercriminals are now selling these stolen credentials on underground forums, leveraging tools like anti-detect browsers to exploit stolen authentication data and scale AI operations, highlighting a growing trend of AI-related cybercrime.
A substantial collection of stolen infostealer logs, released on a Telegram channel on August 2, 2026, has revealed a significant amount of AI-related data, including credentials and API keys. The dump originated from 5,871 infected machines spread across 162 countries. Among the stolen data were thousands of unexpired authentication tokens for services such as Google, Microsoft, Anthropic, Amazon, Notion, Character.ai, Cursor, Poe.com, and Pika AI. Specifically, 44,791 unique JSON Web Tokens (JWTs) were found, with 17.7% containing plaintext personally identifiable information (PII) like names, phone numbers, and email addresses.
Beyond credentials, the analysis uncovered 24 still-valid API keys for AI services, including Google Gemini, OpenAI, Groq, and OpenRouter. These API keys can be weaponized for espionage, extortion, or resource theft, and allow attackers to scale AI operations and rack up AI token bills. The technique, known as LLMjacking, is becoming increasingly prevalent as the cost of premium model access and high-performance compute rises, driving cybercriminals to steal AI accounts and sell them on underground forums.
Okta identified that these stolen credentials can be exploited using ‘anti-detect’ browsers and automation tools like SeleniumBase, which can easily load data from a browser’s sessionStorage and localStorage. The Telegram post flagged by Okta showed vendors selling access to Claude, Cursor, ChatGPT, and Gemini at discounted prices, offering 24/7 support and money-back guarantees. Another service, Poison Claude, provides access to Anthropic’s Opus models.
Google has observed a surge in AI-related cybercrime, with more personas seeking to purchase AI accounts and more sellers advertising these accounts. In one incident response engagement handled by Google’s Mandiant team, a threat actor gained initial access through an exposed GitHub Personal Access Token (PAT) and deployed unauthorized AI infrastructure. Stronger authentication and the use of phishing-resistant technologies like passkeys have made username-and-password takeovers harder, but stolen session tokens and API keys remain a significant vulnerability. The findings underscore the need to secure access to AI systems, monitor for session token reuse, scope API keys, and utilize OAuth 2.0 flows with short-lived tokens.