Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Infostealer malware such as Lumma Stealer and Vidar is harvesting session tokens and API keys from compromised endpoints, allowing attackers to replay these credentials and bypass multi-factor authentication entirely. This highlights a critical flaw in relying solely on MFA: once a valid session token is stolen, the authentication challenge is already solved from the attacker's perspective. AI service providers and enterprise users are particularly at risk because long-lived tokens and API keys are often stored insecurely on disk or in browser profiles. The additional exposure of PII in these logs further amplifies the risk by enabling targeted social engineering attacks against users and organizations.