In the ongoing war between cyber attackers and cyber defenders, the new battleground is the token, this indivisible textual unit consumed and generated by LLM models. Threat actors are increasingly consuming them to carry out their attacks. One way to obtain them is by stealing the authentication data of existing legitimate accounts.
Infostealers are obviously well-positioned to participate in this plundering. Their data capture modules already allow them to retrieve authentication data linked to Claude, ChatGPT, and other accounts. For example, over the last 12 months, Russian Market has listed nearly 260,000 logs for sale, 87,000 of which contain authentication data from LLM services.. This represents approximately 33 %, an increasing rate. Indeed, over the same period a year earlier, it was 26 %. AI data collection is therefore more extensive, perhaps suggesting specific targeting. But it could also simply reflect the increasing adoption of AI services.
OpenAI, a priority target on the Russian Market
The vast majority of the data collected is related to OpenAI (88.65 %), followed by HuggingFace (10.69 %) and Mistral (0.28 %). We observe that Anthropic is virtually absent from the Russian Market metadata. Only about a dozen logs display authentication data linked to anthropic.com or claude.ai. We currently have no clear explanation for this.
What is certain is that Anthropic's services are indeed being targeted by information stealers. Thus, Okta recently got hold of a 7GB dump Retrieved from a Telegram channel, it contained stolen data from 5,871 machines in 162 countries. Inside were 561 Anthropic session tokens, 164 of which were still valid. It also contained 24 valid API keys for services such as Gemini, OpenRouter, OpenAI, and Groq.
Modules dedicated to AI data
Some analytical reports also show that infostealer developers are strengthening their products with features that specifically target AI-related data. For example, Check Point researchers discovered in the infostealer Aokigahara a new module called "aisesessions"«, It is capable of collecting authentication and configuration files from Claude (Code and Desktop), ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, or Gemini CLI. It also retrieves AWS, Azure, and Google Cloud credentials, SSH keys, and Git access.
Gen Digital makes the same observation with Warden Stealer, a malware-as-a-service written in Rust. It has been promoted on underground forums since August 2026. Its version 1.9, announced at the end of September, officially claims the collection of code agent tokens. According to Gen, these files can contain access and refresh tokens, identifiers stored in MCP configurations, as well as… prompt histories and conversation databases.
Indeed, the market value of a stolen AI account is not limited to authentication data. It can also come from other valuable information that threat actors can monetize: source code, documents, sensitive data, integrations, API keys, etc.
Warden and StealC are booming
From an AI data perspective, Warden is currently enjoying significant growth on the Russian Market. It is one of the two infostealers showing the most growth since August, the other being StealC.
AI accounts are thus joining the list of data that infostealers monetize, alongside session cookies and cloud access. Whether this development stems from deliberate targeting or simply the widespread adoption of these services, the result is the same: valid access credentials are circulating, and they are not protected by MFA, which only covers the connection itself and not the subsequent session.
A few precautions are necessary. First, if you have any doubts about a position, revoke sessions and renew API keys, because simply changing your password doesn't invalidate a token that has already been stolen. Furthermore, reduce the lifespan of access (short tokens, refresh token rotation, device-bound sessions when the provider allows it) and do not leave secrets in plain text in agent or MCP server configurations. Finally, treat AI accounts like any other corporate identity asset, with monitoring of abnormal connections and usage. The starting point remains the infection of the workstation: fake installers, cracks and ClickFix remain the main entry points.
How Intrinsec protects you against AI authentication data theft
Anticipating: CTI at the heart of clandestine markets Infostealers are evolving rapidly, and their operators are regularly adding modules dedicated to AI tools. Our team of Cyber Threat Intelligence It continuously monitors log marketplaces, Telegram channels, and emerging stealer families to detect exposure of your accounts, tokens, and API keys. This information is transformed into actionable alerts and detection rules, so you can revoke compromised access before it's reused.
Detect: identify infection and session replay A stolen token bypasses MFA because it represents an already authenticated session. Our SOC and our MDR services They monitor both workstations, to spot typical infostealer behavior, and connections, to identify abnormal usage: unusual geolocation, different device fingerprint, activity outside the holder's hours.
Testing: Measure your actual exposure Our teams Audit and offensive security They replicate the adversaries' attack chain, from the initial infection to token replay. They assess what an attacker could achieve with a compromised system: secrets stored in plaintext in agent or MCP server configurations, session lifetimes, and the scope of API keys. Vulnerabilities are then patched before being exploited.
The strength of our approach lies in the interconnection of these areas of expertise: CTI detects when your access credentials are being used, the SOC tracks their usage, and offensive security verifies that the theft of a token does not grant access to the core of your infrastructure. This complete cycle addresses a threat that now targets your AI tools as much as your traditional access credentials.
