Infostealer-Harvested Replayable AI Session Tokens Bypassing MFA
First seen Sep 10, 2026 · Updated Sep 10, 2026
Threat actors are using commodity infostealer malware (Lumma Stealer, Vidar, and similar families) to harvest session tokens, credentials, and API keys from systems accessing AI platforms like Google and Anthropic. These stolen, replayable tokens allow attackers to bypass MFA entirely and gain persistent illicit access to AI accounts and their connected tooling without needing to re-authenticate.
Technical Analysis
Infostealers like Lumma Stealer and Vidar operate via commodity malware-as-a-service kits distributed through cracked software, malvertising, and phishing lures, exfiltrating browser-stored credentials, session cookies, authentication tokens, and API keys to attacker-controlled C2 panels or Telegram-based log marketplaces. Because many AI platform sessions and API tokens are bearer-style and long-lived, captured tokens can be replayed directly without triggering MFA challenges, effectively nullifying that control layer. Attackers aggregate these logs (often called 'stolen keys' or 'combo lists') and resell or reuse them to access AI provider accounts, potentially escalating to billing abuse, data exfiltration from connected workspaces, or lateral pivoting into integrated services. This directly threatens AI agent and RAG deployments: if a developer or service account's session/API token used for orchestrating LLM tool calls, agent frameworks, or automated pipelines is harvested, attackers can impersonate the agent's identity, exfiltrate proprietary prompts/data, invoke paid model endpoints fraudulently, or inject malicious instructions into downstream agent workflows.
Affected Systems
Developer workstations and endpoints with browser-saved sessions/cookies for AI platforms (Google AI Studio/Gemini, Anthropic Claude, OpenAI, etc.); systems storing API keys in browser storage, environment variables, or config files; CI/CD and automation hosts running agent frameworks with persisted credentials
Indicators of Compromise
- Lumma Stealer C2 panels (variable/rotating domains)
- Vidar Stealer C2 infrastructure (variable/rotating domains)
- Telegram-based stolen log marketplaces
- Browser session cookie exfiltration artifacts
- Unusual API call patterns from unfamiliar IP geolocations on AI provider accounts
Remediation Steps
- 1
Rotate and revoke exposed credentials
Immediately rotate API keys and invalidate active sessions for any accounts suspected of exposure, especially those tied to AI provider platforms and automated agent pipelines.
- 2
Deploy endpoint detection for infostealers
Use EDR/AV signatures and behavioral detection tuned for Lumma Stealer, Vidar, and similar infostealer families targeting browser credential stores.
- 3
Shorten token lifetimes and bind sessions
Implement short-lived, device-bound, or IP-restricted API tokens and session cookies to reduce the replay window if stolen.
- 4
Monitor for anomalous AI API usage
Enable logging and anomaly detection on AI platform accounts for unusual usage volume, geolocation, or billing spikes indicative of token abuse.
- 5
Restrict credential storage in browsers
Enforce policies preventing storage of AI platform credentials/API keys in browsers on developer and automation machines; use dedicated secrets managers instead.
- 6
User awareness on infostealer delivery vectors
Train staff to avoid cracked software, malicious ads, and phishing links that commonly deliver infostealer payloads.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.