{"data":{"id":"8bcfad97-3aad-484c-96a8-752c843cacaf","title":"Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA","summary":"Cybercriminals are using information stealers (malware that harvests data from infected computers) to steal session tokens and API keys for AI services, then selling them on underground forums so attackers can bypass login authentication and MFA (multi-factor authentication, extra security checks beyond passwords). A single stolen data dump contained thousands of unexpired tokens from services like Google, OpenAI, and Anthropic, along with personal information that could enable social engineering attacks.","solution":"Google has added support for Device Bound Session Credentials (DBSC) to Chrome to cryptographically link a session token to a device so that a stolen token cannot be used on another system. Additionally, session replay attacks may not work in scenarios where an organization uses IP allowlisting (a security feature that blocks all network traffic except for specific, approved IP addresses or ranges).","labels":["security","privacy"],"sourceUrl":"https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html","publishedAt":"2026-09-09T14:23:55.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["data_extraction","model_theft"],"issueType":"news","affectedPackages":null,"affectedVendors":["OpenAI","Google","Anthropic","Amazon","Microsoft"],"affectedVendorsRaw":["Google","Anthropic","Amazon","Microsoft","OpenAI","Character.ai","Cursor","Poe.com","Pika AI","Gamma","Notion","Groq","OpenRouter"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-09-09T14:23:55.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}