Infostealer Malware Bypasses MFA to Hijack AI Sessions and Drain Credits

Cybercriminals are deploying infostealer malware to harvest authenticated session tokens from web browsers, allowing them to hijack high-value AI accounts. This technique enables attackers to bypass passwords and multi-factor authentication (MFA) entirely to seize control of services such as Anthropic's Claude.

These attacks function by replaying stolen session tokens. Because these tokens represent a session that has already been authenticated, the attacker does not need to provide a password or an MFA code to gain access. The primary objective of these hijacks is the theft of premium AI compute power; attackers drain high-value credits and quotas to fuel automated data-scraping operations or to power third-party "wrapper" services that resell AI capabilities.

The Endpoint Vulnerability

Unlike traditional breaches that target a company's central servers, these attacks focus on the user's local machine. By compromising the endpoint, malware can extract cookies and session data directly from the browser. This shift in strategy makes server-side security measures largely ineffective, as the AI provider's infrastructure sees the attacker as a legitimate, already-logged-in user.

A variety of commodity malware families are driving this trend. On Windows systems, attackers are utilizing Vidar, Lumma, StealC, RedLine, and Acreed. macOS users are being targeted by Atomic Stealer (AMOS). These tools are designed specifically for the rapid exfiltration of browser credentials and session data, turning simple credential theft into a method for "mining" expensive AI compute resources.

Why Session Hijacking Matters

This trend exposes a critical flaw in modern security architectures: MFA typically only protects the initial login process, not the resulting session. Once a session token is generated and stored in a browser, it becomes a high-value target. As AI tools become deeply integrated into corporate workflows, the implications extend beyond the loss of subscription credits. The ability to bypass MFA via token replay could potentially allow attackers to access sensitive proprietary data processed within an AI's context window.

The monetization of stolen compute power creates a strong financial incentive for malware operators to specifically target AI users, transforming AI subscriptions into a liquid asset for cybercriminals.

What's Next

As AI providers introduce higher-cost subscription tiers and more powerful developer tools, the value of these authenticated sessions is expected to rise. Security researchers are now monitoring whether providers will implement more aggressive session-binding techniques—such as tying tokens to specific hardware fingerprints—to prevent replay attacks. For now, the industry remains vulnerable to any malware capable of reading local browser storage.