7GB Infostealer Dump Yields 1,843 Unexpired AI JWTs Enabling MFA Bypass on OpenAI and Anthropic

Lumma Stealer and Vidar variants harvested session tokens, API keys, and JWTs from infected hosts across 162 countries. The dump surfaced on underground channels where buyers resell the logs for follow-on access. Okta's analysis isolated 44,791 unique JWTs, 2,937 JWEs, and 24 live API keys tied to Gemini, Groq, and OpenRouter. 17.7 percent of the JWTs exposed plaintext PII, creating persistent linkage usable for social engineering.

Replay succeeds because most LLM providers treat valid JWTs or JWEs as authenticated sessions without re-validating device or IP context. Google’s Device Bound Session Credentials and IP allowlisting block reuse in limited deployments, yet the majority of consumer and small-team accounts lack these controls. The pattern mirrors prior credential-stuffing waves but targets high-value compute resources, enabling LLMjacking where attackers run inference at the victim’s expense.

Enterprises adopting AI tooling must rotate tokens on a schedule shorter than typical infostealer dwell time and enforce device-bound or IP-restricted sessions. Without these steps, the next wave of logs will continue supplying ready-made skeleton keys. Procurement records already show rising demand for AI API access on criminal forums, indicating sustained monetization.

Monitoring for anomalous token use and rapid revocation pipelines will determine whether providers can outpace resale velocity. Absent those defenses, PII-linked tokens will fuel both account takeovers and targeted phishing campaigns.