Cybercriminals are harvesting AI user session tokens from information stealer malware logs to hijack AI accounts and bypass multi-factor authentication through token replay attacks, according to research published on September 9. Information stealers like Lumma Stealer and Vidar extract session tokens, API keys, and credentials from compromised systems, and stolen AI tokens remain valid for extended periods — allowing attackers to replay them for unauthorized access without needing passwords or MFA.
Lumma Stealer and Vidar Extract AI Session Tokens from Compromised Systems
Information stealer malware families like Lumma Stealer and Vidar collect authentication artifacts from infected systems, including browser session cookies, saved credentials, and API tokens stored by applications. When victims use AI services from Google, Anthropic, OpenAI, or other providers, these infostealers extract the session tokens that authenticate the user’s access to those platforms.
Session Tokens Remain Valid for Extended Periods After Theft
Stolen AI tokens remain valid for extended periods after extraction, sometimes lasting days or weeks depending on the provider’s token expiration policies. Session tokens are not protected by multi-factor authentication once issued — the MFA check occurs at login, but the session token itself grants access without requiring the user to re-authenticate. Attackers who possess a valid session token can replay it to access the victim’s AI account as if they were the legitimate user.
Attackers Create Illicit Access to AI Services Under Victims’ Accounts
Cybercriminals use stolen session tokens to create unauthorized access to AI tools from providers like Google, Anthropic, and OpenAI. This access enables attackers to consume the victim’s API credits, submit malicious prompts for offensive operations, exfiltrate data from AI conversations or document uploads, or abuse AI services for purposes the victim would never authorize.
MFA Provides No Protection After Session Token Issuance
Multi-factor authentication protects the initial login but does not secure the session token after it is issued. Once an attacker possesses a valid session token extracted by infostealer malware, they bypass the MFA requirement entirely — the token itself is the authentication proof, and the AI service accepts it without challenging the user for additional verification.
This limitation is not unique to AI services but affects any web application that uses session tokens for authenticated access. However, AI accounts present elevated risk because attackers can abuse access to AI capabilities for automated content generation, prompt injection attacks against other users, or large-scale API consumption that generates financial costs for the victim.
Session tokens are designed to balance security and user experience: requiring users to re-authenticate with full credentials and MFA for every API request would create intolerable friction, so applications issue tokens that grant time-limited access without repeated authentication. The tradeoff is that theft of a valid token grants the same access as the legitimate user until the token expires. Information stealers exploit this design by extracting tokens from browser storage or application memory and replaying them from attacker-controlled systems before expiration.
The extended validity periods AI tokens maintain — sometimes lasting days or weeks — increase the window during which stolen tokens remain useful to attackers. Short-lived tokens that expire within minutes or hours limit the value of theft, but long-lived tokens give attackers sustained access even after the victim has cleaned the infostealer infection from their system.
AI providers were urged to implement shorter token expiration windows and token binding mechanisms that tie session tokens to specific device fingerprints or network characteristics. Users should regularly rotate API keys, monitor account activity for unauthorized usage, and deploy endpoint protection against information stealer malware that harvests session tokens before they are transmitted to attacker-controlled servers.
Organizations relying on AI services for business operations should treat infostealer infections as potential AI account compromise events and assume that any session tokens present on infected systems have been exfiltrated. Post-infection response must include forced session revocation, API key rotation, and audit of AI service usage logs to identify unauthorized activity that occurred during the window between token theft and detection.
