Replay kits load a stolen Claude cookie into a fingerprint the service already trusts

The stealer does not have to defeat a login. It opens the Chromium cookie store with the DPAPI key it already holds on the machine, dumps localStorage and sessionStorage, clones extension data directories, and scrapes config files for anything shaped like an API key ^[9]. AI service sessions sit in those cookies and localStorage entries as JWTs ^[9]. The families running that routine are old: Lumma, Vidar, StealC and Redline have been harvesting browser credentials, cookies and autofill data for years ^[8]. Delivery is a cracked software download, a fake CAPTCHA page that talks the user into pasting a PowerShell one-liner, or a malicious npm or PyPI package ^[10].

The run finishes in under thirty seconds, ships everything to a command and control host, and sometimes deletes itself ^[10]. There is no popup, and the session keeps working, because the token was copied and not revoked ^[10]. Buyers then load the cookies through replay kits such as Camoufox or SeleniumBase into a browser fingerprint that matches the victim's original session ^[11]. The service sees the same browser, the same TLS fingerprint, the same cookies, and no 2FA prompt fires, because that session was already authenticated ^[11].

555 AI tokens out of 44,791 is 1.24 percent of the dump ^[1]. The post places the 24 valid keys inside the AI set, so 4.3 percent of those tokens were live ^[2]. At the five dollar bulk rate, buying all 24 costs 120 dollars ^[3]. Sysdig, which coined the term LLMjacking, puts the burn at tens of thousands of dollars of API credits per compromised account ^[12][15]. Read that at its low end, twenty thousand dollars, and a five dollar token returns 4,000 times its price ^[4].

These are numbers about someone else's victim population. For the 1.2 percent AI share to say anything about a given fleet, the infected machines in that one aggregated archive would have to resemble its users: same browsers, same habit of staying signed in for weeks, same mix of consumer and enterprise accounts ^[1]. The 24 keys were live at the moment of analysis, and the write-up does not say how they were tested ^[3].

Of the things an account owner controls, only invalidating the token touches a copy that has already left. After the theft the password is still correct, the second factor is still enrolled, and the fingerprint still matches ^[11]. The interval between rotations is therefore the working lifetime of any session that leaked, and conversation history is inside that window by default, since session tokens read history on every major AI platform, according to the post ^[13]. I would set that interval on the assumption that the copy left quietly and that the provider will see the replay before the user does.