Executive Summary
Criminals use infostealer logs to hijack AI user accounts, replaying stolen session tokens and keys to access Google, Anthropic and other model provider tools while bypassing MFA.
What Happened
Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others. Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide range of data from compromised systems. This can include credential, session tokens, and API
Affected Products
- Google AI
- Anthropic Claude
Vulnerability / Attack Technique
Replay of stolen AI session tokens and API keys
Technical Mechanism
Infostealers capture tokens that work without re-authentication.
AI Security Category
LLM02:2025 Sensitive Information Disclosure
Relevant Frameworks
RealGround Analysis
AI accounts hold conversation history and billable access. RealGround analysis: treat AI sessions and keys as sensitive credentials.
Recommended Controls
- Shorten AI session lifetimes
- Rotate AI API keys after infostealer infections
- Set spend limits on AI keys
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.