Cybercriminals are hijacking user accounts for artificial intelligence platforms by exploiting stolen session tokens and API keys harvested through information stealer malware, according to a report published by identity services provider Okta in September 2026. The company analyzed a 7 GB data dump released on a Telegram channel in August and discovered thousands of valid authentication credentials for AI services from Google, Anthropic, OpenAI, and others. The findings reveal how malicious software like Lumma Stealer and Vidar collects sensitive data from compromised systems, which threat actors then sell on underground forums to enable follow-on attacks that bypass traditional login security.

The stolen data dump contained information from 5,871 infected machines across 162 countries, according to Okta's analysis. Within the dataset, researchers identified 44,791 unique JSON web tokens, of which 555 were likely tied to authentication for AI platforms including Google, Microsoft, Anthropic, Amazon, Gamma, Notion, Character.ai, Cursor, Poe.com, and Pika AI. The company also found 2,937 authentication-related JSON Web Encryption data structures representing encrypted tokens, most of which were set by OpenAI using NextAuth.js. On the day of release, the stolen cache held 1,843 unexpired tokens that could still grant account access. Perhaps most troubling, 17.7% of the JWTs contained plaintext personally identifiable information such as names, phone numbers, or email addresses—details that never expire and could be weaponized for social engineering or phishing campaigns.

"Session tokens and API keys are sought specifically by threat actors because it is often possible to replay those secrets and bypass credential-based authentication," Jeremy Kirk, director of threat intelligence at Okta, said in the report. Once successfully replayed, an attacker effectively gains access to a large language model service without actually logging in, making abuse more challenging but not impossible to detect. Beyond credentials and tokens, the analysis uncovered 24 still-valid API keys for four AI-related services—Google Gemini, OpenAI, Groq, and OpenRouter—which attackers can exploit for espionage, extortion, or resource theft while racking up AI token bills for victims. Google separately disclosed that it has observed more personas seeking to purchase AI-related accounts and more sellers advertising these accounts across the cybercrime underground, with posts indicating buyer demand for Claude and Gemini credentials alongside autonomous coding IDEs like Cursor Pro and Devin.

The report explains that stolen session tokens can be replayed to gain direct account access while bypassing username-and-password authentication as well as multi-factor authentication, a technique that succeeds as long as the tokens haven't expired. Accessing accounts using stolen session data requires specific tooling, and so-called anti-detect browsers have features designed to use stolen authentication data and avoid security controls—tools like the open-source Camoufox or the automation tool SeleniumBase can load data stolen from a browser's sessionStorage and localStorage easily from a file. Attackers who possess stolen API keys can engage in what's known as LLMjacking, abusing the keys to gain unauthorized access to a victim's large language model and using the services to accomplish their goals or selling the access to other cybercriminals. This abuse mirrors cryptocurrency mining campaigns that secretly consume a system's resources while passing heavy compute bills to the victim. Google's Threat Intelligence Group noted that the cost of premium model access and high-performance compute is one of the primary barriers for threat actors seeking to operationalize AI, resulting in increased targeting, exfiltration, and sale of AI accounts across cybercrime communities.

The findings underscore an urgent need to secure access to AI systems through measures like monitoring for session token reuse, scoping API keys, and using OAuth 2.0 flows with short-lived tokens that expire quickly in the event of theft, according to Okta. Session replay attacks may not succeed in scenarios where an organization uses IP allowlisting, a security feature that blocks all network traffic except for specific approved IP addresses or ranges, and Google has added support for Device Bound Session Credentials to Chrome to cryptographically link a session token to a device so that a stolen token can't be used on another system. Kirk emphasized that as frontier model access grows more expensive, the incentive to steal rather than pay for it grows too, and while stronger authentication and phishing-resistant technologies like passkeys have made username-and-password takeovers harder, they don't stop a stolen session token or API key. The emergence of new black market sites selling stolen token bundles, complete with 24x7 support and money-back guarantees for discounted access to services like Claude and ChatGPT, signals that the commodification of AI account access has become an established revenue stream in the cybercrime economy. Enterprises racing to adopt generative AI face a dual challenge: securing their own users from credential theft while defending cloud environments against intrusions designed to hijack expensive compute resources for unauthorized workloads.