aviatrix logoAviatrix
Under Active Attack

Executive Summary

In August 2026, cybersecurity researchers analyzed a 7GB infostealer dump containing data from 5,871 infected machines across 162 countries, revealing thousands of unexpired authentication tokens for AI services including Google, OpenAI, Anthropic, and others. Information stealers like Lumma Stealer and Vidar harvested session tokens, API keys, and JSON Web Tokens (JWTs) that threat actors can replay to bypass credential-based authentication and multi-factor authentication, effectively gaining unauthorized access to premium AI services without traditional login processes. The stolen data included 555 AI-related JWTs and 2,937 encrypted tokens, with 17.7% containing plaintext personally identifiable information, enabling account takeovers, resource theft, and unauthorized AI service usage sold on underground markets.

This incident highlights the growing cybercriminal focus on AI credential theft as premium model access costs create strong financial incentives for stealing rather than purchasing legitimate access, while the proliferation of anti-detect browsers and session replay tools makes monetizing these stolen tokens increasingly accessible to threat actors.

Why This Matters Now

As AI adoption accelerates in enterprise environments, cybercriminals are increasingly targeting AI credentials and session tokens to bypass expensive premium model costs, creating a new attack vector that traditional MFA cannot prevent when session tokens are stolen and replayed.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Session tokens and API keys can be replayed to access accounts without triggering traditional username/password or MFA prompts, as the tokens represent already-authenticated sessions that haven't expired.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would be highly relevant to this AI service credential theft campaign as it could significantly reduce attacker lateral movement across cloud platforms and limit the blast radius of compromised AI service accounts through network segmentation and controlled egress policies.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: CNSF visibility and monitoring capabilities would likely provide early detection of suspicious credential harvesting activities and abnormal authentication patterns across cloud-hosted AI services, potentially reducing the time attackers could operate undetected.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero trust network segmentation would likely constrain the scope of access even with valid JWT tokens, limiting attackers to specific network segments and reducing their ability to access sensitive AI service resources across the entire cloud environment.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely constrain lateral movement between different AI service platforms and cloud environments, forcing attackers into more limited network paths and reducing their ability to pivot freely across multiple services.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Unified multicloud visibility would likely detect anomalous proxy-based connections and suspicious geographic access patterns across different AI platforms, potentially disrupting persistent command and control channel establishment through compromised accounts.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely limit unauthorized data extraction from AI service environments and constrain the volume of sensitive credential data that could be exfiltrated to external command and control infrastructure or underground marketplaces.

Impact (Mitigations)

While some unauthorized AI resource consumption and credential sales could still occur, the overall financial impact and scope of LLMjacking operations would likely be significantly reduced due to constrained network access and limited lateral movement capabilities.

Impact at a Glance

Affected Business Functions

  • AI/ML Development Operations
  • API Service Management
  • Customer Account Security
  • Compute Resource Management
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Exposure of 44,791 JSON web tokens including 555 AI service authentication tokens, 2,937 encrypted JWE tokens, and 24 valid API keys for AI services. 17.7% of tokens contained plaintext PII including names, phone numbers, and email addresses affecting users across 162 countries from 5,871 infected machines.

Recommended Actions

  • • Implement egress security controls to detect and block unauthorized AI API communications and prevent token exfiltration to underground markets
  • • Deploy zero trust segmentation with identity-based policies to limit lateral movement between compromised systems and AI service accounts
  • • Enable multicloud visibility and anomaly detection to identify suspicious AI resource consumption patterns and LLMjacking activities
  • • Enforce encrypted traffic controls and secure hybrid connectivity to protect authentication tokens in transit from infostealer harvesting
  • • Establish threat detection capabilities to baseline normal AI usage patterns and alert on token replay attacks and anti-detect browser usage

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image