AI Account Hijacking: How Infostealers Bypass MFA via Token Theft

The security perimeter of the modern enterprise has shifted. For years, business owners and IT managers have operated under the assumption that Multi-Factor Authentication (MFA) was the definitive shield against unauthorized access. If a password was leaked, the second factor—a code on a phone or a biometric scan—would stop the intruder. However, a growing trend in the cybercrime ecosystem is rendering this defense obsolete by targeting the aftermath of the login process rather than the login itself.

Recent intelligence reveals that threat actors are increasingly utilizing information stealers, such as Lumma Stealer and Vidar, to harvest session tokens and API keys. These digital artifacts are the "proof of login" issued by a service after a user has already successfully authenticated. By stealing these tokens, attackers can perform a session replay attack, effectively stepping into an active session without ever needing a password or an MFA prompt.

The mechanics of the digital room key

To understand why this is so effective, one must view the authentication process as a hotel check-in. The password and MFA are the ID and credit card presented at the front desk. Once the clerk verifies the identity, they hand over a room key. From that moment on, the guest is not asked for their ID every time they enter the room; the key itself is the proof of authorization. Token theft is the equivalent of an attacker stealing that room key from a guest's pocket.

In technical terms, these keys often take the form of JSON Web Tokens (JWTs) or session cookies. When a user logs into a platform like Microsoft 365 or Google Workspace, the browser stores these tokens to ensure the user isn't prompted to log in every few minutes. Infostealers are specifically designed to scour browser profiles, local storage, and session databases to find these high-value targets. Once extracted, these tokens are bundled into "stealer logs" and sold on underground forums or shared via Telegram channels.

AI services become prime targets

While traditional corporate email and cloud storage remain targets, there is a surging interest in Artificial Intelligence (AI) accounts. A recent analysis of a 7 GB infostealer dump released on a Telegram channel on August 2, 2026, highlighted the scale of this vulnerability. The dataset contained information from 5,871 infected machines across 162 countries, including thousands of unexpired authentication tokens for a wide array of AI-driven tools.

The affected services identified in the dump include:

Google, Microsoft, Anthropic, Amazon, Gamma, Notion, Character.ai, Cursor, Poe.com, and Pika AI.

Of the 44,791 unique JWTs found in the dataset, 555 were directly related to AI services. Furthermore, researchers identified 2,937 JSON Web Encryption (JWE) structures, mostly associated with OpenAI, which utilizes NextAuth.js. While JWEs are encrypted and can only be parsed by the party holding the decryption key, they can still be replayed by an attacker to gain account access as long as the token has not expired.

Beyond access: The risk of plaintext PII

The danger of these leaks extends beyond the immediate hijacking of an AI account. The analysis conducted by Okta revealed a troubling detail: 17.7% of the 44,791 JWTs contained plaintext personally identifiable information (PII). This includes names, phone numbers, and email addresses embedded directly within the token.

Unlike a session token, which eventually expires, PII is permanent. This data allows threat actors to link a specific individual to a specific AI service, providing a roadmap for highly targeted social engineering or phishing campaigns. An attacker knowing exactly which AI tools a corporate executive uses can craft a deceptive message that appears legitimate, further compromising the organization's internal security.

Why traditional MFA fails to stop replay

The fundamental flaw is that MFA is a point-in-time check. It verifies the user at the start of the session. Once the session is established, the service trusts the token. Session tokens are bearer credentials, meaning whoever bears the token is treated as the authenticated user. If an infostealer captures a valid cookie from a browser, the attacker can import that cookie into their own browser and inherit the trust already granted to the victim.

This bypass is faster and more reliable for criminals than attempting to defeat MFA through SIM swapping or phishing for one-time codes. It allows them to enter the system silently, often without triggering the security alerts that usually accompany a failed login attempt or a password change.

Defensive strategies and technical countermeasures

While the threat is significant, it is not insurmountable. Security professionals are moving toward "continuous authentication" and device-binding to close the gap. One of the most effective defenses is IP allowlisting, which restricts network traffic to specific, approved IP addresses. If a token is stolen but the attacker attempts to use it from an unauthorized IP, the request is blocked.

Additionally, there are advancements in how tokens are tied to hardware. Google has introduced support for Device Bound Session Credentials (DBSC) in Chrome. This technology cryptographically links a session token to a specific device, ensuring that even if a token is stolen, it cannot be replayed on a different machine. For businesses, this underscores the need for rigorous endpoint hygiene and the deployment of advanced EDR (Endpoint Detection and Response) tools to catch infostealers before they can exfiltrate browser data.

Global business implications: USA, UK, and International Markets

For entrepreneurs and enterprises in the USA and UK, this shift in attack vectors necessitates a revision of corporate security policies. In these markets, where the adoption of AI tools for business productivity is highest, the risk of intellectual property theft via AI account hijacking is acute. Many companies allow employees to use AI tools via "Bring Your Own Account" (BYOA) or loosely managed corporate accounts, creating a massive blind spot for security teams.

From a regulatory perspective, the presence of plaintext PII in stolen tokens could trigger notification requirements under the GDPR in the UK and various state-level privacy laws in the USA (such as the CCPA in California). If a company's AI integration leads to the exposure of customer or employee PII through insecure token handling, they may face significant legal liabilities.

International firms must move beyond the "MFA is enough" mindset. The focus must shift toward securing the endpoint and implementing shorter session lifetimes to reduce the window of opportunity for replay attacks. As AI becomes more integrated into core business operations, the session token is no longer just a convenience—it is a high-value asset that requires the same level of protection as a master password.

FAQ

Sources: Thehackernews, Ismalicious, Cyberunit ·