Information stealer malware is harvesting session tokens from AI platform users, enabling cybercriminals to replay those tokens and gain full account access without triggering multi-factor authentication (MFA).
The attack chain is straightforward but effective. Malware families such as Lumma Stealer and Vidar extract session tokens, credentials, and API keys from compromised machines. These tokens, once sold on dark web marketplaces, can be replayed by buyers to access premium AI services—including platforms from Google, Anthropic, and other major providers—bypassing MFA entirely because the authentication step has already been completed.
Why AI Sessions Are Now Premium Targets
The market for stolen credentials has evolved. AI platform accounts now command higher prices than typical social media or email logins because they offer access to powerful compute resources, integrated data repositories, and often pre-paid credits. For attackers, a single stolen AI session token can yield far more value than a compromised social media account, particularly when the associated platform has access to proprietary code, corporate documents, or internal knowledge bases.
The core issue is a fundamental limitation in how most authentication systems work: once a user passes MFA and receives a session token, that token becomes the sole credential for the duration of the session. No further MFA challenge is required. If the token is stolen, the attacker inherits the authenticated session as though they were the legitimate user.
The Risk for Development Workflows
Many engineering workflows now depend on AI-assisted coding tools and large language model APIs for code generation, documentation, and review. Session tokens for these tools often persist across browser restarts and can linger for days or weeks without reauthentication.
Teams using browser-based AI platforms face the greatest exposure, as browser session data is a primary target for information stealers. Corporate environments that lack dedicated endpoint detection and response (EDR) tools—or that allow developers to use personal browsers for work AI services—are especially vulnerable.
The data privacy dimension is equally concerning. If a stolen session grants access to an AI platform seeded with proprietary code or internal documents, the attacker may retrieve sensitive corporate information through the same interface the developer uses. For organisations subject to data protection regulations or industry-specific compliance requirements, this could constitute a reportable data breach.
Browser-Based Tools vs. Dedicated Alternatives
The threat landscape raises practical questions about tool selection. Browser-based AI coding assistants—accessed entirely through web sessions—are inherently more exposed to token theft than locally installed alternatives. Dedicated applications such as Cursor or Codeium, which run as native desktop clients with their own authentication flows and local storage, offer a narrower attack surface because they do not share browser session state with potentially compromised web sessions.
However, no tool is immune. Any application that relies on long-lived session tokens without device binding is susceptible to replay attacks. The key differentiator is whether the platform cryptographically ties tokens to a specific device or limits session lifetimes aggressively.
Defending Against Token Replay
Security researchers recommend a layered approach. On the provider side, stronger session-binding mechanisms—such as TLS certificate pinning or client-side cryptographic tokens tied to device fingerprints—would make stolen tokens useless on other machines. Shorter session lifetimes and real-time anomaly detection for unfamiliar IP addresses or geographies would further limit the window of exploitation.
For organisations, the practical steps include enforcing dedicated browser profiles or standalone applications for AI tools, maintaining robust endpoint protection to block infostealers before they execute, and establishing clear policies on what data may be entered into AI platforms.
Individual developers should avoid installing untrusted software, use separate browser profiles for professional AI tools, and log out of sessions when not in use to invalidate tokens proactively.
As AI-assisted development becomes standard practice, treating access to these platforms with the same security discipline applied to source code repositories and production infrastructure is no longer optional—it is a baseline requirement.
資訊竊取惡意軟件正竊取人工智能平台用戶的會話代幣，使網絡犯罪分子得以重放這些代幣，在無需觸發多因素驗證（MFA）的情況下完全控制帳戶。
攻擊鏈直接而有效。包括Lumma Stealer和Vidar在內的惡意軟件系列會從受感染電腦中提取會話代幣、憑證及API金鑰。這些代幣一旦在暗網市場出售，買家即可重放以存取付費人工智能服務——包括Google、Anthropic及其他主要供應商的平台——完全繞過MFA，因為身份驗證步驟已完成。
為何AI會話成為高價目標
竊取憑證的市場已不斷演進。人工智能平台帳戶現時的價值高於一般社交媒體或電郵登入憑證，因為這些帳戶可存取強大運算資源、整合數據儲存庫，通常還包含預付額度。對攻擊者而言，單一被竊的AI會話代幣所帶來的價值可能遠超被入侵的社交媒體帳戶，尤其當關聯平台涉及專有代碼、企業文件或內部知識庫時。
核心問題在於多數身份驗證系統運作的根本限制：一旦用戶通過MFA並取得會話代幣，該代幣即成為整個會話期間的唯一憑證。無需進一步MFA挑戰。若代幣被竊，攻擊者便可繼承已驗證的會話，如同合法用戶一般。
對開發工作流程的風險
許多工程流程現依賴人工智能輔助編程工具及大型語言模型API進行代碼生成、文件撰寫及審查。這些工具的會話代幣往往可跨越瀏覽器重啟持續存在，在無需重新驗證下維持數天或數週。
使用瀏覽器內人工智能平台的團隊面臨最大暴露風險，因為瀏覽器會話數據是資訊竊取軟件的主要目標。缺乏專用端點偵測及回應（EDR）工具的企業環境，或容許開發者使用個人瀏覽器處理工作AI服務的機構，尤其脆弱。
數據私隱層面同樣令人擔憂。若被竊會話可存取載有專有代碼或內部文件的人工智能平台，攻擊者可能透過開發者使用的相同界面取得敏感企業資訊。對於受數據保護法規或特定行業合規要求約束的機構，這可能構成需通報的數據外洩事件。
瀏覽器工具 vs. 專用替代方案
威脅形勢引發了關於工具選擇的實際考量。完全透過網頁會話存取的瀏覽器內人工智能編程助手，本質上比本地安裝的替代方案更易遭受代幣竊取。Cursor或Codeium等專用應用程式作為原生桌面客戶端運行，具備獨立身份驗證流程及本地儲存，因不與可能被入侵的網頁會話共享瀏覽器會話狀態，提供了更小的攻擊面。
然而，沒有任何工具能完全免疫。任何依賴長期會話代幣而不綁定裝置的應用程式，都可能遭受重放攻擊。關鍵區別在於平台是否透過加密方式將代幣綁定至特定裝置，或嚴格限制會話有效期。
防禦代幣重放
安全研究人員建議採取多層防禦。供應商方面應實施更強的會話綁定機制——例如TLS憑證固定或綁定裝置指紋的客戶端加密代幣——使竊取的代幣在其他機器上失效。縮短會話有效期及對異常IP地址或地理位置進行即時異常檢測，可進一步限制漏洞利用窗口。
機構方面，實際措施包括強制使用專用瀏覽器配置檔或獨立應用程式處理AI工具、維護強大端點保護以在資訊竊取軟件執行前將其阻擋，並制定關於可輸入AI平台數據的明確政策。
個別開發者應避免安裝不受信任的軟件、為專業AI工具使用獨立瀏覽器配置檔，並在不使用時登出會話以主動使代幣失效。
隨著人工智能輔助開發成為標準實踐，以對待原始碼儲存庫及生產基礎設施相同的紀律來管理這些平台的存取權限，已不再是可選項——而是基本要求。