Infostealer Logs Found to Contain Replayable AI Tokens That May Bypass MFA
A growing security concern has emerged as researchers analyze data from infostealer malware campaigns. These attacks, which harvest sensitive information from compromised systems, have been found to include authentication tokens for AI services alongside the usual credentials.
The critical issue lies in how many AI platforms implement their authentication systems. Unlike traditional web applications, some AI services rely on long-lived tokens that, once stolen, can be replayed to gain access to user accounts without needing the original password or, in some cases, even bypassing multi-factor authentication prompts.
Researchers note that AI platforms often prioritize user experience over security hardening, leading to token lifetimes that are excessively long. This design choice means that if an attacker obtains a valid token—through an infostealer infection, for example—they can maintain persistent access to the victim's AI accounts indefinitely.
Organizations and individuals are advised to regularly audit active sessions on AI platforms, implement hardware security keys where supported, and monitor for unauthorized token usage. Security teams should also consider extending endpoint detection and response capabilities to monitor for the signatures associated with infostealer malware families known to harvest AI tokens.