TL;DR: Your password held. Your two-factor code held. And someone still got into your account. That is the unsettling reality behind a new wave of attacks hitting AI users right now. A major AI provider has started warning customers that criminals are lifting their saved login sessions off infected computers, then using those sessions to sign in as them. No password guessing. No 2FA prompt. The account just opens, because to the system, the attacker looks like a user who is already logged in.
What Happened?
The provider began signing affected users out and stripping saved payment cards from their accounts, then emailing them to explain why. The cause was infostealer malware sitting on the victim’s own machine. This kind of malware is built to stay quiet. It does not lock files or demand money like ransomware. It copies saved passwords, browser cookies, and active login tokens, then ships them to a remote server, in some cases in batches every few minutes.
One victim traced the infection back to a pirated game that carried a hidden stealer. It pulled their browser credentials, cookies, and session IDs. The malware families flagged in this campaign include Vidar, Lumma, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer on a small number of Macs. Standard antivirus did not catch it.
What’s the Impact?
Here is the part that should worry every team, not just AI users. Two-factor authentication did not stop this. It could not. The attacker never faced a login screen. A stolen session token is proof that 2FA already passed, so the account never asks again. That is session hijacking, and it turns MFA into a speed bump the attacker simply drives around.
The reach goes well beyond one product. The same stealer that grabs an AI session also grabs email, cloud, and SSO tokens from the same browser. Research this year tied infostealers to billions of stolen credentials across millions of devices. One infected laptop can quietly expose a whole stack of corporate accounts. And the theft keeps working after the malware is gone, because the stolen tokens live off the device.
Infostealers hijacking AI login sessions
Behavioral and family-level indicators reported in the current campaign. No fabricated hashes or IP artifacts. Treat family names as time-sensitive.
Malware families named in this campaign
Behavioral indicators to hunt for
- Usage that refills then drains while the real user is idle. The clearest account-side signal.
- Active sessions from unfamiliar IPs or geographies on AI and SaaS accounts.
- Logins with no matching password or 2FA event, a sign of replayed session cookies.
- Repeated outbound connections on a short timer from an endpoint, credentials sent in batches every few minutes.
- Browser cookie and saved-credential files accessed by an unexpected process.
Common delivery routes
- Pirated games, cracks, keygens, and repacked installers.
- Unofficial downloads and malicious apps posing as legitimate software or updates.
- Malvertising and SEO-poisoned “free software” pages.
Response note: Removing the app does not undo the theft. Stolen cookies and tokens work off-device, so revoke and rotate. Wipe and rebuild the endpoint if a stealer ran, reset passwords from a clean device, and sign out every session to invalidate copied tokens.
How to Avoid This
- Treat any machine that ran a stealer as compromised. Back up clean data and rebuild it rather than trusting a quick removal, since many stealers plant restore files.
- Reset passwords from a device you trust, never the infected one.
- Sign out everywhere and revoke active sessions to kill the stolen tokens attackers are replaying.
- Move high-value accounts to passkeys or hardware keys, which bind login to the device and blunt cookie replay.
- Watch for the tell: usage or activity that spikes while you are idle. That is often a hijacked session at work.
- Steer clear of pirated software, cracks, and unofficial downloads. That is the front door for most of these infections.
Why a stolen cookie walks past your 2FA
Attackers are not cracking passwords. They copy the login session your browser already holds, then replay it. To the account, that stolen session looks like you, already signed in.
Infection
A pirated game, cracked app, or fake update drops infostealer malware onto the machine. It runs quietly, no locked files, no alert.
EndpointHarvest
It copies saved passwords, browser cookies, and live session tokens, then ships them to a remote server in batches every few minutes.
ExfiltrationReplay
An attacker loads the stolen session token. No password prompt. No 2FA challenge. The account treats them as an already-signed-in user.
Account TakeoverThe token is proof that 2FA already passed, so 2FA never gets asked again. That is why victims saw usage refill and drain while they were not even logged in.