Cybercriminals Are Selling Stolen AI Accounts Using Infostealer Logs

Cybercriminals are increasingly using information-stealing malware to hijack AI accounts and API credentials, creating a growing underground market for unauthorized access to services such as Google Gemini, Anthropic Claude, ChatGPT, Cursor, and other AI platforms.

Security researchers at Okta analyzed a 7 GB infostealer dump published on Telegram on August 2, 2026. The dataset contained information from 5,871 infected machines across 162 countries, including thousands of authentication tokens and credentials associated with major AI and cloud services.

Among 44,791 unique JSON Web Tokens (JWTs) found in the dump, researchers identified 555 tokens likely associated with AI services. Overall, 1,843 JWTs and encrypted JWE tokens were still valid when the dataset was released.

Stolen Session Tokens Can Bypass MFA

Information stealers such as Lumma Stealer and Vidar are designed to collect credentials, browser cookies, session tokens, API keys, and other sensitive information from compromised systems.

Unlike stolen passwords, valid session tokens can sometimes allow attackers to access an account without entering the username, password, or even completing multi-factor authentication.

This makes stolen AI session tokens particularly valuable to cybercriminals.

Researchers also found that 17.7% of the JWTs contained plaintext personally identifiable information (PII), including names, phone numbers, and email addresses. Such information could later be used for phishing, impersonation, or social-engineering attacks.

AI API Keys Are Also Being Stolen

The investigation also discovered 24 still-valid API keys belonging to four AI-related services, including:

  • Google Gemini
  • OpenAI
  • Groq
  • OpenRouter

Attackers can abuse stolen API keys to access AI models, consume computing resources, conduct espionage, or generate large bills for the legitimate account owner.

This type of abuse is commonly referred to as LLMjacking, where attackers hijack someone else's AI infrastructure or account access for their own operations.

Underground Market for AI Accounts

The stolen credentials are already being monetized through cybercrime communities.

Okta observed Telegram advertisements offering discounted access to services such as Claude, Cursor, ChatGPT, and Gemini, with some sellers even advertising customer support and money-back guarantees.

Another underground service, reportedly called Poison Claude, advertised access to multiple Anthropic Claude models.

Cybercriminals can use anti-detect browsers and automation frameworks to replay stolen browser session data while attempting to avoid security mechanisms such as impossible-travel and behavioral detections.

AI Accounts Are Becoming a Valuable Target

Google has also reported seeing increased demand for AI-related accounts in underground marketplaces.

Threat actors are reportedly searching for credentials to services such as Claude and Gemini, as well as AI-powered coding environments including Cursor Pro and Devin.

Google's Mandiant incident-response team also observed a case where an attacker obtained access to a cloud environment through an exposed GitHub Personal Access Token (PAT) and then used the compromised environment to deploy unauthorized AI infrastructure and consume high-performance computing resources.

The growing cost of premium AI models and cloud GPU infrastructure is making stolen AI credentials increasingly attractive to cybercriminals.

How to Stay Protected

Organizations and individuals should:

  • Revoke compromised API keys immediately.
  • Rotate API keys regularly and give them the minimum required permissions.
  • Use short-lived OAuth 2.0 tokens wherever possible.
  • Monitor for unexpected AI API usage and unusual token consumption.
  • Detect session-token reuse from unfamiliar devices or locations.
  • Enable phishing-resistant authentication such as passkeys.
  • Avoid storing long-lived credentials in browsers or source-code repositories.
  • Monitor cloud accounts for unexpected compute resources or infrastructure.
  • Immediately terminate active sessions after an infostealer infection.

The key takeaway is that changing a password alone may not be enough after an infostealer infection. If attackers have stolen valid session tokens or API keys, those credentials must also be revoked or rotated.

As AI services become more expensive and increasingly integrated into enterprise workflows, stolen AI accounts and API credentials are becoming another valuable commodity in the cybercrime ecosystem.