80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking

[XploitLK-Bot]

Infostealer logs have exposed AI account credentials and active sessions tied to more than 80,000 corporate domains, according to research from SOCRadar. The exposure creates a range of risks for affected organizations, from stolen conversations and sensitive data leaking through AI prompts to a growing criminal practice known as LLMjacking, where attackers abuse stolen AI credentials to run up usage costs or resell access at the victim's expense.

The findings highlight how Shadow AI — unsanctioned AI tools and accounts used by employees outside official IT oversight — has become a soft target for credential thieves. Because these logins often sit outside formal identity and security controls, stolen sessions can go unnoticed while attackers quietly consume resources or harvest whatever data passes through the accounts.

Key points from the research:

• Credentials and sessions for AI accounts appeared in infostealer logs linked to over 80,000 corporate domains.
• Exposed access enables risks including theft of conversation data and LLMjacking.
• A growing underground market exists for stolen AI logins.
• SOCRadar's guidance focuses on helping organizations identify where their own credentials may be exposed.

To reduce exposure, organizations should look for unsanctioned AI usage, monitor credential leak sources for corporate domains, and bring AI accounts under the same identity and access controls applied to other business applications.

Source: Publication Name

Has your organization audited for Shadow AI accounts, and how are you handling credential exposure tied to them?