Infostealer Malware Targets AI Accounts with Session Cookie Theft

• •Infostealer malware now targets generative AI accounts, stealing session cookies.
• •Over 49,700 stolen session cookies from AI platforms are circulating on the dark web.
• •Attackers can access AI accounts without passwords, compromising both personal and corporate data.

Infostealer malware has evolved to target generative AI accounts, stealing session cookies to bypass traditional authentication methods like passwords and two-factor verification. A report by KELA revealed that over 49,700 session cookies from AI platforms were sold on the dark web from January to July 2026, many of which remain valid for logins. This malware not only compromises personal data but also corporate resources, as employees use AI for sensitive tasks. Microsoft previously identified 900,000 installations of malicious browser extensions that collected sensitive AI conversation data. A recent analysis by Octa found 555 authentication tokens linked to AI services among 44,791 tokens extracted from infected PCs. The theft of API keys for platforms like Google Gemini and OpenAI has also been confirmed, allowing attackers to exploit AI services at the victims' expense. The situation highlights the emerging criminal ecosystem around stolen AI credentials.