Infostealers Are Becoming a Source of AI Credentials

Information stealers such as Lumma Stealer and Vidar are designed to collect a wide range of sensitive information from compromised devices, including:

• Usernames and passwords;
• Session tokens;
• Cookies;
• API keys;
• Browser data;
• Authentication information associated with online services.

Once collected, the data is often packaged into stealer logs and sold through Telegram channels or underground cybercrime forums.

Session tokens and API keys are particularly valuable because they can sometimes be replayed to access an account without going through the normal authentication process.

Nearly 45,000 JWTs Found in a Single Dataset

Okta analyzed an approximately 7 GB infostealer dataset published through a Telegram channel on August 2, 2026.

The dataset reportedly contained information collected from 5,871 infected machines across 162 countries.

Researchers identified thousands of unexpired authentication tokens associated with services including:

• Google;
• Microsoft;
• Anthropic;
• Amazon;
• Notion;
• Character.ai;
• Cursor;
• Poe;
• Pika AI;
• Gamma.

Of the 44,791 unique JSON Web Tokens, or JWTs, identified in the dataset, at least 555 were likely associated with authentication to AI services.

A valid JWT can sometimes be replayed to obtain direct account access without requiring a username and password or completing multi-factor authentication again.

OpenAI Authentication Data Was Also Present

Okta also discovered 2,937 authentication-related JSON Web Encryption, or JWE, structures.

Most of these tokens were reportedly associated with OpenAI authentication using NextAuth.js.

Although JWE content is encrypted and cannot easily be decoded without the appropriate key, an attacker may still be able to replay a valid token while it remains active.

At the time the dataset was released, approximately 1,843 JWTs and JWEs were still unexpired.

Tokens Can Expose Personal Information

Researchers identified another security concern: approximately 17.7 percent of the JWTs contained personally identifiable information in plaintext.

This information included data such as:

• Names;
• Email addresses;
• Phone numbers.

Unlike authentication tokens, this information does not lose its value when a session expires.

Threat actors can use the exposed data to create targeted phishing and social engineering campaigns.

Valid AI API Keys Found in the Dataset

Using TruffleHog to analyze the stealer data, researchers uncovered 24 still-valid API keys associated with four AI-related services:

• Google Gemini;
• OpenAI;
• Groq;
• OpenRouter.

A valid API key can allow an attacker to consume resources belonging to the victim for purposes such as:

• Intelligence gathering;
• Running AI models;
• Automated operations;
• Reselling access;
• Consuming large volumes of AI tokens;
• Generating significant charges for the legitimate account owner.

The Rise of LLMjacking

The unauthorized use of stolen credentials or API keys to access Large Language Model services is increasingly referred to as LLMjacking.

The technique resembles cryptojacking.

In a cryptojacking campaign, attackers secretly use a victim's computing resources to mine cryptocurrency.

With LLMjacking, attackers instead target:

• AI APIs;
• Premium AI models;
• GPU resources;
• Cloud compute;
• AI token quotas.

The legitimate account owner ultimately receives the bill.

A Black Market for AI Accounts Is Emerging

As premium AI services become more valuable and more expensive, compromised AI accounts are becoming attractive commodities in underground markets.

Okta observed Telegram vendors advertising discounted access to services including:

• Claude;
• Cursor;
• ChatGPT;
• Gemini.

Some vendors even offered 24-hour customer support, discounted pricing and money-back guarantees.

Other underground services have advertised access to high-end Anthropic models.

The activity indicates that a growing commercial ecosystem is emerging around compromised AI accounts and stolen authentication data.

Anti-Detect Browsers Help Replay Stolen Sessions

Using stolen session data often requires specialized tooling capable of recreating the victim's browser environment.

So-called anti-detect browsers can import data from browser sessionStorage, localStorage, cookies and other session-related sources.

Browser automation frameworks may also be used to load stolen session data from files and configure proxy services.

The use of proxies can help attackers avoid detections based on geographic anomalies, impossible travel or other behavioral indicators.

Threat Actors Are Increasingly Targeting AI Accounts

Google has also observed growing demand for AI-related credentials in cybercrime communities.

Accounts and services of interest include:

• Claude;
• Gemini;
• Cursor Pro;
• Devin;
• AI coding environments;
• Accounts with premium model access.

In one incident investigated by Mandiant, an attacker obtained initial access to a victim's cloud environment through an exposed GitHub Personal Access Token.

The attacker then used the compromised environment to deploy unauthorized AI infrastructure and scale high-performance computing resources.

Why AI Accounts Are Becoming Attractive Targets

One of the main barriers preventing threat actors from using advanced AI at scale is cost.

Premium models and high-performance GPU infrastructure can generate significant expenses.

Instead of paying for those resources directly, cybercriminals increasingly have an incentive to:

• Steal AI accounts;
• Obtain API keys;
• Compromise cloud environments;
• Resell access;
• Use enterprise resources to operate AI workloads.

The growing adoption of AI therefore creates another opportunity for criminals to monetize information collected by infostealers.

What Organizations Should Do

Organizations using AI services should treat session tokens and API keys as highly sensitive authentication credentials.

Recommended security measures include:

• Scope API keys to the minimum permissions required;
• Rotate and revoke API keys regularly;
• Use OAuth 2.0 flows with short-lived access tokens;
• Monitor session token use from unusual devices or IP addresses;
• Apply IP allowlisting where appropriate;
• Monitor AI API consumption and token usage;
• Configure spending limits and quotas;
• Detect abnormal authentication and API activity;
• Protect endpoints against information-stealing malware;
• Avoid storing API keys in browsers, unprotected configuration files or exposed repositories.

Security mechanisms such as Device Bound Session Credentials can also reduce the risk of token replay by cryptographically linking an authentication session to a specific device.

Passkeys and MFA are making traditional username-and-password account takeovers more difficult. However, MFA alone cannot prevent account abuse when an attacker already possesses a valid session token or API key.

As access to advanced AI models and high-performance computing becomes more expensive, protecting AI credentials, sessions and API keys will become an increasingly important part of enterprise cybersecurity.