New research finds that infostealer log collections are surfacing replayable authentication tokens for AI platforms that can be used to bypass multi-factor authentication, extending the credential-theft economy into the AI-access layer. As organisations increasingly grant conversational agents and AI applications privileged access through session tokens, those tokens are becoming a fresh target in stealer malware output. Defenders are advised to treat AI-platform session tokens as highly sensitive, enforce short-lived sessions and rotation, and monitor infostealer feeds for AI-companion credentials.

Source

• The Hacker News — Infostealer Logs Expose Replayable AI Tokens That Bypass MFA (2026-09-09)