As reported by The Hacker News, Okta's analysis of a 7GB infostealer dump released on Telegram in August 2026 reveals that AI service session tokens and JSON Web Tokens (JWTs) are being harvested by malware and sold on underground forums — enabling attackers to bypass MFA and gain direct access to AI platforms from Google, Anthropic, OpenAI, and others.

AI Security Alert: This isn't novel in identity security circles, but the application to AI services is.

MFA Was Never Designed for Token Theft

The core finding — that 1,843 unexpired JWTs and JWEs were available the day the dump was released — underscores a long-known but persistently under-addressed problem: session tokens bypass MFA by design. MFA gates the authentication process, but once a valid session token is issued, the bearer is assumed to be legitimate. Infostealers like Lumma and Vidar don't need to defeat MFA; they simply steal the artifact that MFA produced.

This isn't novel in identity security circles, but the application to AI services is. The attack surface has expanded dramatically in the last 18 months as enterprises and individuals have adopted dozens of AI tools — many of which use browser-based authentication flows that store session artifacts locally. Each new AI subscription is another potential skeleton key sitting in a browser cookie store or local credential vault.

Why AI Tokens Command a Premium

AI service credentials are uniquely valuable for several reasons:

MFA Was Never Designed for Token Theft
Monetary value: LLM API access is metered and expensive. A stolen API key or session token can be replayed to run inference at the victim's expense — or worse, to exfiltrate proprietary prompts, training data, or conversation history.
Long-lived sessions: Many AI tools prioritize user convenience over session expiration, resulting in tokens with extended lifetimes.
Weak session management: The Okta analysis notes that 2,937 JWE structures were found, most tied to OpenAI's NextAuth.js implementation. While JWEs are encrypted, they can still be replayed by an attacker without decryption — the service will accept the opaque blob if it hasn't expired.

PII in Tokens: A Secondary Exposure

Nearly 18% of the JWTs in the dump contained plaintext PII — names, phone numbers, email addresses. JWTs are base64-encoded, not encrypted by default, and developers frequently embed claims that shouldn't be there. This creates a compounding risk: even if a token expires, the PII inside it does not. Threat actors can use this data for targeted phishing campaigns that reference the victim's specific AI tool usage — a potent social engineering vector.

The convergence of infostealer economics and AI tool adoption means every employee's browser is now an unmanaged API key vault. Most security teams don't even know which AI services their users have authenticated to.

Shield53 Recommendations

  • Inventory AI service usage: Run browser telemetry or endpoint discovery to identify which AI platforms your workforce has authenticated to. You cannot protect what you haven't inventoried.
  • Enforce short session lifetimes: Where possible, configure AI services to use short-lived tokens (15–60 minutes) with refresh token rotation rather than long-lived sessions.
  • Deploy EDR with infostealer detection: Lumma, Vidar, and similar stealers have known behaviors — registry access patterns, browser cookie/database file reads. Ensure your EDR rules cover these.
  • Use managed browser profiles: For enterprise AI subscriptions, use managed browser profiles with SSO integration so that session tokens are tied to corporate identity rather than personal accounts.
  • Audit JWT claims: If you operate AI services, audit your JWT implementation for unnecessary PII in claims. Strip sensitive data and use opaque identifiers instead.
  • Implement token revocation on password reset: Ensure that password changes or MFA re-enrollment invalidate all existing session tokens — not all providers do this by default.
  • Monitor AI API usage patterns: Detect anomalous consumption spikes that may indicate token replay — unusual geographic origin, off-hours activity, or abnormally high token usage.

The intersection of AI adoption and credential theft is going to get worse before it gets better. The threat model for AI services isn't just prompt injection or model abuse — it's the mundane reality that users authenticate to these services through the same browsers that infostealers have been targeting for years.