Recent reporting indicates that information stealer malware such as Lumma Stealer and Vidar are being used to harvest reusable session tokens and API credentials from compromised endpoints. These tokens, once extracted, can be replayed by attackers to gain illicit access to artificial intelligence platform accounts from Google, Anthropic, and other providers. The technique allows bypass of multi-factor authentication protections by reusing valid session identifiers rather than performing credential-based login. The scope of affected accounts and the precise mechanics of the token replay process remain under investigation.

What should defenders do?

Organizations should enforce short token lifetimes, regular rotation, and monitor for anomalous AI account activity. Users should enable strong, phishing-resistant MFA and review connected app permissions. Vendor advisories recommend rotation of compromised tokens.

highPrivacy

Infostealer Logs Enable Replay of AI Session Tokens, Bypassing MFA Protections

Cybercriminals harvest and replay session tokens from compromised systems to gain unauthorized access to AI model provider accounts, circumventing multi-factor authentication.

CyberIntel DeskPublished 20 days agoUpdated less than a minute ago1 min read

Infostealer Logs Enable Replay of AI Session Tokens, Bypassing MFA Protections

Key Takeaways

Information stealer malware (Lumma Stealer, Vidar) harvests session tokens and API credentials from compromised systems.
Replayed session tokens can grant unauthorized access to AI model provider accounts, bypassing MFA.
The technique targets Google, Anthropic, and other AI model platforms globally.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read