Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
Summary: Okta analyzed a 7 GB infostealer dump posted to a Telegram channel on August 2, 2026, finding data from 5,871 infected machines in 162 countries, including 555 JWTs likely tied to AI service authentication and 24 still-valid API keys for Google Gemini, OpenAI, Groq, and OpenRouter. Of 44,791 unique JWTs in the dataset, 1,843 unexpired JWTs and JWEs were present on release day, and 17.7% of the JWTs contained plaintext PII such as names, phone numbers, or email addresses.
What's compelling: A stolen session token or API key replays straight past the username, password, and MFA controls you have spent years tightening - Okta notes passkeys do not stop it - and 24 live AI API keys in a single dump means someone else can run your model bills up while you read the invoice.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026