AI Token Theft and MFA Bypass: Lessons From Infostealer Logs

AI accounts have become valuable enough to appear in infostealer logs sold on underground marketplaces. Okta’s threat intelligence team analyzed a leaked stealer dump and found thousands of unexpired authentication tokens tied to AI services. Attackers are not just stealing passwords anymore. They are replaying live sessions and API keys to walk past MFA entirely.

This shifts the risk for enterprises adopting generative AI tools. A stolen password alone rarely grants access when MFA is enforced. A stolen session token or API key can. Once an attacker replays that token, the AI service treats them as an already-authenticated user, and username-password checks never trigger.

What Okta found inside the stealer dump

Okta reviewed a stealer log released on a Telegram channel in August 2026. The dump included credentials, cookies, and authentication tokens harvested from compromised endpoints. Two token types stood out for AI-specific risk:

• JSON Web Tokens (JWTs): 44,791 unique JWTs were present, and 555 were linked to AI service authentication. A valid JWT grants direct account access without a fresh login.
• JSON Web Encryption (JWE) structures: 2,937 encrypted token objects were found, mostly tied to OpenAI’s use of NextAuth.js. These require the issuing service’s key to decrypt, but an attacker can still replay an unexpired JWE to gain access without ever decrypting it.

Okta treated these as two distinct mechanisms. JWTs work as direct bearer tokens. JWEs work as replayable session artifacts even while remaining opaque to the attacker. Both routes skip password and MFA checks entirely.

A separate concern surfaced in the same dataset: 17.7% of the 44,791 JWTs carried plaintext personally identifiable information, including names, phone numbers, and email addresses. That data does not expire the way a token does, and it links a specific person to a specific AI service, which raises phishing and social engineering risk on its own.

Why session replay defeats MFA

MFA verifies a login event. It does not verify every request made during a session. Infostealer malware such as Lumma Stealer and Vidar harvest session tokens directly from browser storage, cookies, and local files, capturing an already-authenticated state.

Attackers then load that stolen session data into tooling built for exactly this purpose:

• Anti-detect browsers (such as Camoufox) that mimic legitimate browser fingerprints to avoid detection.
• Automation frameworks (such as SeleniumBase) that import stolen sessionStorage and localStorage data from a file.
• Proxy configurations that defeat impossible-travel and behavioral anomaly triggers by matching the victim’s expected geography.

Two controls can blunt session replay specifically. IP allowlisting blocks traffic from outside approved ranges, which limits where a replayed token can be used. Google’s Device Bound Session Credentials, now generally available in Chrome on Windows, cryptographically ties a session token to the originating device so a copied token fails on another system. Neither control is universal yet, which is why token lifetime and endpoint hygiene still carry most of the weight.

Featured resource

Cybersecurity kit

Download this cybersecurity kit for blueprints, frameworks, checklists, policy templates, and guides securing your enterprise.

DOWNLOAD

Stolen AI access as a cybercrime category

The report also points to a maturing market for stolen AI accounts. Okta identified Telegram sellers offering discounted access to Claude, Cursor, ChatGPT, and Gemini, complete with support and refund guarantees. A separate listing, described as Poison Claude, advertised access to multiple Anthropic model versions.

Google’s Threat Intelligence Group corroborated the trend, reporting increased buyer demand for AI credentials paired with coding tools like Cursor Pro. In one Mandiant incident response case, a threat actor used an exposed GitHub Personal Access Token to deploy unauthorized AI infrastructure inside a victim’s cloud environment.

This pattern of using stolen API keys to run up compute costs or resell access, known as LLMjacking, mirrors older cryptomining abuse campaigns where victims absorbed the compute bill.

Where endpoint hygiene fits

Session and API key theft starts with endpoint compromise, which puts this squarely in identity security and endpoint management territory. Hexnode addresses this across three connected layers of defense.

• Hexnode XDR detects malicious process activity on managed Windows endpoints and isolates the device on confirmation. This blocks lateral movement before stolen tokens can leave the network.
• Hexnode UEM reduces the attack surface that infostealers exploit. It enforces patch management and browser extension policies that limit what can read or exfiltrate browser-stored session data.
• Hexnode IdP enforces compliance-based conditional access. It blocks login attempts from devices flagged as unenrolled or non-compliant, which stops a replayed session from reaching protected resources even if the token itself is valid.

Conclusion

AI access now carries the same stakes as privileged account access, and it needs governance to match. MFA remains a necessary control, but this report shows it is not sufficient on its own against session replay and stolen API keys.

Enterprises adopting AI tools should treat endpoint compromise, token lifetime, and identity-aware monitoring as a single connected problem rather than three separate checklist items.