Over Five Thousand Corporate AI Logins Captured in Infostealer Campaigns
Infostealer malware is harvesting AI platform credentials at scale across thousands of organizations. SOCRadar examined more than one million infostealer records tied to AI services, narrowing the analysis to 482 established enterprises. Sixty-eight percent of those companies are billion-dollar organizations spanning 36 countries and eight sectors. The study identified 5,434 stealer-log records linked to 1,500 distinct corporate email addresses, with 295 of the companies appearing in logs within 90 days of the report.
OpenAI sessions account for nine in ten captured records
ChatGPT or OpenAI credentials appeared for 358 of the 482 companies analyzed, and those organizations account for approximately 90 percent of all records. Zapier, Notion, Hugging Face, Replit, Lovable and ElevenLabs follow at significantly lower volumes. Claude and Gemini do not rank among the most-captured platforms.
Researchers attribute ChatGPT's dominance to adoption patterns rather than platform security. Early market entry means more employees registered using work email addresses on personal devices, creating a larger population for infostealers to harvest. As competing assistants gain enterprise users, researchers expect the distribution to balance.
Session cookies allow attackers to skip credential prompts
A session cookie replays as a live authenticated session. Okta's Jeremy Kirk has noted that attackers target session tokens and API keys because replay bypasses credential checks entirely. Changing the password does not terminate an active session, leaving the attacker signed in.
Employees frequently paste proprietary code, customer data, contracts and unreleased product details into AI prompts. The account functions as a searchable corporate archive; anyone who replays the session inherits that history without breaching internal infrastructure.
OAuth-connected automation tools extend attacker reach
Automation platforms maintain OAuth grants for CRM systems, email and cloud storage. A compromised Zapier session, the report notes, lets an adversary construct a workflow that siphons data on a schedule, originating from the vendor's IP range and appearing as routine automation.
API keys stored in notes applications or workspace settings files are captured alongside credentials, then either billed to the victim or sold in underground markets. Cybercrime vendors advertise discounted Claude, Gemini and Cursor accounts with refund guarantees.
Technology firms lead exposure but risk spans all sectors
Technology and internet-services companies represent 144 of the affected organizations and 40 percent of captured records. Industrials, financial services, retail, healthcare and energy also appear throughout the dataset.
Nearly all sectors show LLM-platform exposure; energy leads at 93 percent of affected companies. Agent and automation compromise, which inherits employee permissions across third-party systems, concentrates in healthcare, financial services and technology organizations.
Measures to limit credential and session theft
The report recommends treating AI platforms with the same controls applied to identity providers and code repositories. SSO configuration removes stored passwords but does not invalidate existing session cookies or retroactively protect accounts created before policy enforcement.
- Require SSO with short-lived sessions for every AI platform. Configure OAuth 2.0 or OIDC with refresh-token rotation so stolen cookies expire rapidly.
- Apply scope limits and usage caps to API keys. Configure alerts for access from unfamiliar autonomous-system numbers or anomalous hours.
- Detect session-token reuse by monitoring for changes in country or device fingerprint during a single session lifetime.
- Handle any employee in a stealer log as an endpoint compromise, not merely a credential reset.
- Identify which corporate domains already appear in stealer-log repositories before attempting remediation.
Anthropic's incident response offers a remediation model
In late August, BleepingComputer reported that Anthropic addressed infostealer-driven Claude hijacking by terminating active sessions, removing stored payment methods and issuing refunds for transactions identified as fraudulent.
The company invalidated sessions, stripped payment instruments abused by attackers and alerted users whose endpoints were infected. Security leaders should recognize that exposure migrates with employees; policy gaps widen wherever users operate outside managed controls.
Questions readers ask
Why does ChatGPT appear in stealer logs more often than Claude or Gemini?
Researchers attribute the disparity to market timing rather than platform defenses. ChatGPT's earlier launch means substantially more employees registered with work addresses on unmanaged devices, creating a larger target population for infostealers. As enterprise adoption of competing assistants grows, captured-credential distribution is expected to even out.
How does a stolen session cookie bypass multi-factor authentication?
A captured cookie functions as an active authenticated session that can be replayed. Okta's Jeremy Kirk has explained that attackers seek session tokens and API keys specifically because replay circumvents credential-based checks. Password rotation leaves the session valid and the intruder logged in.
What is LLMjacking?
LLMjacking refers to the theft and abuse of AI platform API keys. Attackers extract keys from infected endpoints, then either bill inference costs to the victim's account or resell discounted platform access in underground markets, often with guarantees. Vendors advertise Claude, Gemini and Cursor access at below-market rates.
Which industries showed the highest agent and automation exposure?
Healthcare, financial services and technology organizations display the greatest concentration of agent and automation compromise, which grants attackers the employee's standing authority across connected third-party systems. LLM-platform exposure remains near-universal, peaking at 93 percent of affected energy companies.
What should an organization do if its domain appears in a stealer log tied to AI platforms?
Treat every employee in a stealer log as an endpoint incident requiring investigation, not a simple password reset. A session that changes geography or device fingerprint mid-session indicates replay. Implement SSO with short-lived sessions and refresh-token rotation to limit stolen-cookie validity.
Source and reporting limits
Based on reporting by BleepingComputer. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.