Okta finds replayable AI tokens in infostealer data
Okta has identified replayable authentication material for artificial intelligence services in a 7 GB infostealer dump released on Telegram on August 2, 2026. The dataset came from 5,871 infected machines in 162 countries and contained 1,843 unexpired JSON Web Tokens and JSON Web Encryption structures on the day of release.
Information stealers such as Lumma Stealer and Vidar can collect credentials, browser session tokens and API keys from compromised devices. Criminal buyers can then obtain stealer logs on underground forums and use the stolen data for follow-on access to accounts and services.
Session replay changes the MFA equation
Okta analysed 44,791 unique JSON Web Tokens in the dump, with 555 likely associated with authentication for AI services. A valid JWT can be replayed to access an account directly, avoiding the usual username, password and multi-factor authentication steps.
Okta director of threat intelligence Jeremy Kirk described session tokens and API keys as secrets that can act as “skeleton keys” when replayed successfully. This does not make abuse undetectable, but it can make detection more difficult because the attacker is effectively using an already authenticated session.
The data also included 2,937 authentication-related JSON Web Encryption structures, or encrypted JWTs. Okta said most were set by OpenAI, which uses NextAuth.js. An attacker may not be able to decrypt those tokens, but can still replay an unexpired token to obtain account access.
AI services and API keys are becoming targets
The exposed tokens were linked to services including Google, Microsoft, Anthropic, Amazon, Gamma, Notion, Character.ai, Cursor, Poe.com and Pika AI. Okta also found 24 still-valid API keys for four AI-related services: Google Gemini, OpenAI, Groq and OpenRouter.
Stolen API keys can be used for unauthorised model consumption, espionage, extortion or resource theft, while leaving the account owner with AI token charges. The practice of using compromised credentials to access large language model services or resell that access is known as LLMjacking.
Okta noted that anti-detect browsers and tools such as Camoufox and SeleniumBase can load authentication data from browser sessionStorage and localStorage files. Proxy configuration can also help adversaries evade impossible-travel and behavioural controls that might otherwise expose unauthorised access.
Controls must protect sessions as well as sign-in
Session replay is less likely to work where IP allowlisting limits traffic to approved addresses or ranges. Google has also added Device Bound Session Credentials to Chrome, cryptographically tying a session token to a device so that a stolen token cannot be used on a different system.
The dataset carried a further privacy risk: 17.7% of the JWTs contained plaintext personally identifiable information, including names, phone numbers or email addresses. Unlike a session expiry, that information does not disappear and may support targeted phishing or social engineering.
For businesses expanding AI use, strong passwordless sign-in and MFA remain important but do not eliminate token theft. Teams should monitor for session reuse, restrict and rotate API keys, use OAuth 2.0 flows with short-lived tokens, and apply network or device-binding controls where their services support them.