Case okta-infostealer-ai-tokensLLMjackingSep 8, 2026Worldwide

Okta: free Telegram stealer dump holds thousands of live AI session tokens and 24 API keys

Okta analysed a 7 GB stealer log dump of 5,871 machines posted free on Telegram on 2 August 2026 and found 24 valid AI API keys plus thousands of unexpired session tokens for Google, Microsoft, Anthropic and Amazon.

HighAttack on AIStatus: OngoingVerified case file

Open in the interactive map Cite this case

Reported: Sep 8, 2026
Location: Worldwide
Target: Users of Google, Microsoft, Anthropic, Amazon and OpenAI AI
Severity: High
Triggered by: Unknown
Actor type: Criminal
Reported loss: None reported
CVE: None

What happened

Impact: 9,213 unexpired Google and 1,763 Microsoft session tokens, 164 Anthropic and 254 Amazon tokens, 24 valid keys for Gemini, OpenAI, Groq and OpenRouter; 1,843 unexpired JWTs and JWEs, many from OpenAI.

Who triggered it

Actor: Unknown

Attribution: Okta analysis of a dump used as a teaser for paid stealer-log subscriptions; operators unidentified.

Motive: Resale of replayable AI access and subscription upsell

How it happened

Attack vector: Infostealer logs containing browser session cookies, JWTs and API keys replayed through anti-detect browsers and proxies

Root cause: Long-lived AI session tokens and API keys stored on endpoints without device binding or usage caps

Timeline

Aug 2, 2026Stealer log dump released free on a Telegram channel
Sep 8, 2026Okta publishes analysis

Response

Okta recommended session-reuse detection, device-bound credentials, short-lived tokens, API usage caps and IP allowlisting.

Current status: Ongoing

Sources (open in a new tab)

Okta Threat Intelligence okta.com
The Hacker News thehackernews.com

Cite this case

Okta: free Telegram stealer dump holds thousands of live AI session tokens and 24 API keys. AI Threat Watch, case okta-infostealer-ai-tokens, Sep 8, 2026. https://aithreat.io/cases/okta-infostealer-ai-tokens/

Permanent link: https://aithreat.io/cases/okta-infostealer-ai-tokens/