hacker-news Sep 9, 2026 · Crawled Sep 9, 2026

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

3 IoCs 2 Malware

AI Summary

Information stealer malware such as Lumma Stealer and Vidar are harvesting session tokens and API keys from compromised systems, enabling threat actors to replay these credentials and gain unauthorized access to AI services like Google Gemini, OpenAI, Anthropic, and others, bypassing multi-factor authentication. A 7 GB infostealer dump analyzed by Okta contained 44,791 unique JSON Web Tokens (JWTs), 555 of which were likely tied to AI service authentication, along with 2,937 encrypted JWE structures, primarily from OpenAI. Attackers are using stolen tokens to access premium AI models and sell access on underground forums, leveraging anti-detect browsers like Camoufox to avoid detection. The abuse of valid, unexpired API keys and tokens—termed 'LLMjacking'—allows attackers to conduct espionage, resource theft, or run up AI service bills on victims.

AI-extracted · verify before operational use

Extracted Entities 2 found

Malware Lumma Stealer → Malware Vidar →

Indicators of Compromise 3 extracted

Type	Value	Detail
GitHub Repo	Camoufox	Details →
Filename	sessionStorage	Details →
Filename	localStorage	Details →

MITRE ATT&CK TTPs 39 techniques

T1027 Obfuscated Files or Information · Defense Evasion T1059.001 PowerShell · Execution T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1090 Proxy · Command And Control T1114.001 Local Email Collection · Collection T1133 External Remote Services · Persistence T1555 Credentials from Password Stores · Credential Access T1558 Steal or Forge Kerberos Tickets · Credential Access T1566 Phishing · Initial Access T1574.002 DLL Side-Loading · Persistence T1012 Query Registry · Discovery T1027.013 Encrypted/Encoded File · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1057 Process Discovery · Discovery T1082 System Information Discovery · Discovery T1102.001 Dead Drop Resolver · Command And Control T1105 Ingress Tool Transfer · Command And Control T1112 Modify Registry · Defense Evasion T1113 Screen Capture · Collection T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1203 Exploitation for Client Execution · Execution T1204.002 Malicious File · Execution T1212 Exploitation for Credential Access · Credential Access T1484.001 Group Policy Modification · Defense Evasion T1490 Inhibit System Recovery · Impact T1542.001 System Firmware · Persistence T1543.003 Windows Service · Persistence T1548.002 Bypass User Account Control · Privilege Escalation T1552.001 Credentials In Files · Credential Access T1555.003 Credentials from Web Browsers · Credential Access T1564.003 Hidden Window · Defense Evasion T1588.001 Malware · Resource Development T1608.001 Upload Malware · Resource Development T1685 T1685