Overview
A 7 GB infostealer dump released on Telegram in August 2026 has been found to contain thousands of unexpired authentication tokens granting access to major AI platforms, including OpenAI, Anthropic, Google, Amazon, Cursor, Character.ai, and Poe.com. Analysis by Okta’s threat intelligence team identified 1,843 unexpired JSON Web Tokens (JWTs) and JSON Web Encryption (JWE) structures on the day of the dump’s release — all of which could be replayed to access AI accounts without providing credentials or satisfying MFA challenges.
This represents a meaningful escalation in the abuse of infostealer infrastructure, extending well beyond traditional banking and email account compromise into the AI tooling ecosystem.
Technical Analysis
Infostealers such as Lumma Stealer and Vidar are sold as off-the-shelf malware-as-a-service offerings. Once deployed on a victim machine, they harvest stored credentials, browser session cookies, API keys, and authentication tokens. This data is packaged into “stealer logs” and sold on underground forums and Telegram channels.
The critical risk identified in this dataset relates to JWT and JWE token replay. JWTs are cryptographically signed tokens that encode a user’s authenticated session state. When a service receives a valid, unexpired JWT, it grants access without requiring re-authentication — meaning username, password, and MFA are all bypassed entirely.
Of the 44,791 unique JWTs in the dump, 555 were linked to AI service authentication. An additional 2,937 JWE structures — encrypted JWTs primarily associated with OpenAI’s use of NextAuth.js — were also identified. While JWEs cannot be decrypted without the server-side key, they remain fully replayable: the server decrypts and validates them, granting access if the token is unexpired.
A further concern is that 17.7% of all JWTs in the dataset contained plaintext PII (names, phone numbers, email addresses), which does not expire and enables targeted phishing or social engineering even after session tokens have been rotated.
Framework Mapping
- AML.T0012 (Valid Accounts): Threat actors use stolen tokens to operate as legitimate authenticated users within AI platforms.
- AML.T0113 (Steal Web Session Cookie): JWT and JWE tokens function analogously to session cookies and are harvested by the same infostealer mechanisms.
- AML.T0114 (AI Service Web Interface): Replayed tokens provide direct access to AI service web interfaces and APIs.
- AML.T0040 (AI Model Inference API Access): API keys harvested alongside session tokens enable programmatic model access.
- LLM06 (Sensitive Information Disclosure): Plaintext PII embedded in JWTs constitutes a direct disclosure risk.
Impact Assessment
The affected platforms span the major commercial AI ecosystem. Developers using Cursor or API keys for OpenAI and Anthropic face risks of intellectual property exposure, prompt history exfiltration, and unauthorised model usage costs. Enterprise users of AI tooling integrated into productivity platforms (Notion, Gamma) face broader data access risks. The 162-country spread of the compromised machines indicates this is not a targeted campaign but a broad opportunistic harvest.
Mitigation & Recommendations
- Rotate credentials proactively: Any organisation with employees using AI tools should treat infostealer incidents as requiring immediate token and API key rotation across all AI platforms.
- Enable IP allowlisting: Where supported, restrict AI platform access to known corporate IP ranges to neutralise replay attacks from foreign infrastructure.
- Adopt Device Bound Session Credentials (DBSC): Google’s DBSC implementation in Chrome cryptographically binds session tokens to a device, preventing off-device replay.
- Monitor for anomalous AI API usage: Unusual query volumes, off-hours access, or unexpected geographic origins should trigger session invalidation.
- Deploy EDR to detect infostealer activity: Early detection of Lumma Stealer or Vidar infections limits the exfiltration window.