Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others. Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide range of data from compromised systems. This can include credential, session tokens, and API

The article reports that infostealer malware like Lumma and Vidar is exfiltrating AI-related credentials, session tokens, and API keys from infected systems, enabling criminals to hijack user accounts for AI tools from providers such as Google and Anthropic. These stolen, replayable tokens can effectively bypass MFA protections on AI services by reusing active sessions, turning compromised endpoints into a supply-chain vector into cloud AI platforms. From a RealGround perspective, organizations should treat AI access tokens and API keys as high-value secrets, harden endpoint security, and implement token lifecycle controls (short-lived tokens, revocation, and behavioral monitoring) to limit damage from infostealer-driven compromise. RealGround can also help assess AI supply-chain exposure and continuously test how easily stolen credentials and tokens could be abused against production AI systems.