Information stealers like Lumma Stealer and Vidar are built to harvest a broad range of data from compromised systems, including credentials, session tokens, and API keys. Because these tokens can be replayed, attackers may be able to bypass MFA protections and gain access to AI accounts without triggering typical authentication barriers.

Key points:

• Attackers rely on infostealer logs to obtain replayable AI tokens.
• Lumma Stealer and Vidar are cited as examples of malware capable of harvesting credentials, session tokens, and API keys.
• Affected providers include Google, Anthropic, and other model providers.
• Replayable tokens can allow access that circumvents MFA.

Source: The Hacker News

Has your organization reviewed AI account tokens and session logs for signs of replay-based access?