Security1 publisher3 min readPublished
Stealer logs now carry AI session tokens that replay straight past MFA
Okta's read of one Telegram stealer dump shows commodity malware now hoovering up AI session tokens and API keys, and a replayed token walks past MFA because the second factor was spent when the token was minted.
The Watch · Security desk
What happened
- Okta analysed a 7 GB infostealer dump that was published to a Telegram channel on August 2, 2026, and reported its findings to The Hacker News.
- The log held data taken from 5,871 infected machines in 162 countries, the routine output of commodity stealer operations rather than a targeted breach.
- Of 44,791 unique JSON Web Tokens in the dataset, Okta assessed 555 as authentication tokens for AI services.
- On the day the dump was released, 1,843 of its JWTs and encrypted JWEs were still unexpired and therefore replayable.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Credential hygiene runs out at the moment of theft: a stolen token grants account access without the password and without the second factor, so rotation and MFA enforcement leave the intruder in place until the token expires or is revoked.
- cost Stolen API keys move the inference bill to the account holder, the same economics as cryptojacking, and the theft shows up as usage rather than as an intrusion.
- exposure 17.7 percent of the JWTs carried plaintext names, phone numbers or email addresses, which Kirk notes do not expire, so revoking every session still leaves attackers a roster tying named people to the AI services they use.
A JWT sitting in a browser profile is a bearer credential: whoever holds it can get direct account access without a username, a password, or a second factor [9]. Jeremy Kirk, Okta's director of threat intelligence, says a replayed secret leaves an attacker "effectively logged in to an LLM service without actually logging in," and that the resulting abuse is "more challenging but not impossible to detect" [8]. Detection is where the work lands, because there is no failed login to alarm on and no MFA prompt to deny.
The encrypted tokens are the same problem in a wrapper. Most of the 2,937 authentication-related JWE structures Okta pulled from the dump were set by OpenAI, which uses NextAuth.js, and while only the key holder can decrypt them, decryption is not the attack: replay only needs the token to still be unexpired [5].
The AI slice of this harvest is thin. 555 of 44,791 JWTs works out to 1.2 percent [16]. Count the OpenAI-set JWEs as AI tokens too and the total is 3,492 [17]. Of all 47,728 tokens, 1,843 were unexpired on release day, or 3.9 percent [18]. Okta's report describes "thousands of unexpired authentication tokens" tied to Google, Microsoft, Anthropic, Amazon, Gamma, Notion, Character.ai, Cursor, Poe.com and Pika AI [15][4], which sits awkwardly beside its own total of 1,843, and it does not say how many of the 555 AI JWTs were among the live ones [19]. So: a modest number of live AI sessions in one dump, produced by a supply chain that ships dumps continuously, since Lumma Stealer and Vidar operators resell logs on underground forums as a matter of routine [13].
API keys are the durable half. TruffleHog scanning found 24 still valid across Google Gemini, OpenAI, Groq and OpenRouter [10]. On the resale side, one Telegram vendor flagged by Okta offers discounted access to Claude, Cursor, ChatGPT and Gemini with 24x7 support and money-back guarantees, and a service called Poison Claude advertises Anthropic's Opus 4.8, 4.7 and 4.6 alongside Sonnet 4.6 [14]. Advertising specific model tiers means the seller knows which account it is selling, not merely that something works.
Two things break replay, and Okta names both. IP allowlisting drops traffic from outside approved ranges, and Google's Device Bound Session Credentials in Chrome cryptographically tie a session token to the device it was issued to [12]. Both are configurations an organisation applies. Neither is standing between a stolen cookie and an account for the developer who signed into Cursor and Gemini on the same laptop that ran Vidar [13]. For that account, expiry and revocation are the entire defence, and revocation begins with knowing the token left.
What to watch
- Whether Google, OpenAI or Anthropic disclose how many exposed sessions and how many of the 24 API keys they revoked, and how long those keys had been live.
- Whether the next public stealer dump shows an AI share above the 1.2 percent of JWTs Okta measured in this one.
- Whether any model provider makes device-bound sessions the default for individual paid accounts rather than an enterprise option.