I checked the latest reporting from The Hacker News and the original Okta Threat Intelligence research published on September 9, 2026. The core finding is that cybercriminals are stealing AI account session tokens and API keys from infected computers, creating a way to access AI services without using the normal login process. Infostealer malware such as Lumma Stealer and Vidar can collect credentials, browser session tokens and API keys, which are later packaged into logs and traded by attackers. These stolen secrets are especially valuable because valid session tokens can sometimes be replayed, allowing attackers to enter an already authenticated AI account without completing another MFA challenge.

Okta researchers examined a 7GB collection of infostealer data released through a Telegram channel on August 2, 2026, containing information from 5,871 infected machines. The infected systems were spread across 162 countries, showing how widely this type of stolen authentication data can be distributed through cybercriminal channels. Researchers searched the dataset for authentication-related information and discovered thousands of tokens connected with major technology and AI services, including Google, Microsoft, Anthropic, Amazon and other platforms. The researchers stressed that the numbers came from this particular dataset and should not be interpreted as a measurement of the overall popularity or usage of those services.

Among the findings were 561 unique Anthropic authentication tokens, of which 164 were still unexpired when the dataset was released, while other AI-related services also appeared in the stolen information. The dataset also contained 44,791 unique JSON Web Tokens, with 555 identified as likely connected to authentication for AI services, although not every JWT found was related to AI. Some JWTs can remain valid for periods ranging from minutes to months or even years, while shorter-lived tokens may be created using longer-lived refresh tokens that malware can also target. Researchers additionally found 2,937 authentication-related encrypted JWTs, with 1,843 JWTs and encrypted JWTs still unexpired when the infostealer dataset was released.

The investigation also found that JWTs can expose personal information because some tokens may contain details such as names, email addresses and phone numbers in readable form. Of the 44,791 JWTs examined, 17.7% contained plaintext personally identifiable information, creating another possible advantage for attackers conducting phishing or social engineering campaigns. The bigger concern is that stealing an already authenticated token can work differently from stealing a password because the attacker may not need to trigger the normal authentication process again. This means stronger login protections such as MFA can make password-based account takeover harder, but they do not automatically prevent abuse when an active authentication token has already been stolen.

The threat is particularly important as access to advanced AI models becomes more valuable and expensive, giving criminals a stronger financial reason to steal accounts instead of paying for legitimate access. Okta noted cases where stolen AI access resulted in extremely high costs, including incidents involving hundreds of thousands of dollars in AI credits and other unauthorized usage. Attackers can also target API keys because they may provide persistent machine-to-machine access, making poorly protected keys another valuable target inside infostealer logs. The research shows that this does not necessarily require highly sophisticated techniques, because the stolen authentication material can already be collected automatically by malware and then searched by criminals.

Security teams therefore need to treat session tokens and API keys with the same seriousness as passwords, while also monitoring for suspicious reuse of previously issued sessions. Organizations should limit and properly scope API keys, use short-lived authentication tokens where possible, and consider OAuth 2.0 flows that reduce the useful lifetime of stolen credentials. Phishing-resistant authentication and passkeys remain important because they make traditional credential theft more difficult, but additional controls are needed to address stolen sessions and reusable tokens. Okta also points to wider adoption of Device Bound Session Credentials as a technology that could eventually make stolen session data much harder for criminals to replay successfully.

Stay alert, and keep your security measures updated!

Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news