What if an attacker doesn’t need your password or your MFA code because they can steal access that has already been authenticated?
That question was at the center of the September 23 episode of the CHIPS Cybersecurity Podcast, where we looked at the next generation of infostealers targeting AI tools, API keys, session tokens, configuration data and other credentials tied to AI applications and agents.
The timing matters because recent research shows this is no longer just a theoretical concern.
Infostealers are evolving beyond traditional username and password theft. They are increasingly targeting authenticated browser sessions, tokens, API keys and other artifacts that may represent existing access.
Key Takeaway: MFA remains essential, but attackers are increasingly targeting what exists after MFA succeeds. As businesses adopt more AI tools and agents, MSPs need to think about protecting not only credentials, but also the authenticated sessions, API keys and access tokens sitting on endpoints.
A recent Cloud Security Alliance research note examined Okta findings involving a 7 GB infostealer dataset collected from 5,871 infected machines across 162 countries.
Researchers identified 44,791 unique JSON Web Tokens, or JWTs. Of those, 1,843 were still unexpired when the dataset was released, and 555 were associated with AI services. Researchers also found 24 valid AI-provider API keys.
That distinction matters.
Traditional credential theft gives an attacker information they can try during a future authentication attempt.
A valid session token can represent something different: authentication that has already happened.
If an attacker can successfully replay that token, they may not have to initiate the normal username, password and MFA process again.
This does not mean MFA failed. It means the attacker may be targeting the access created after MFA did its job.
Because AI tools increasingly have access to valuable business resources.
Employees and developers may use AI applications to interact with source code, documents, cloud environments, internal systems, APIs and sensitive business information.
That means an infected endpoint can potentially contain more than passwords.
The target is shifting from simply stealing credentials to stealing usable access.
Yes. Recent reporting indicates that stolen AI credentials and authentication artifacts are already appearing in underground cybercrime markets.
VentureBeat reported on infostealer data containing authentication artifacts associated with services including Google, Microsoft, Anthropic, Amazon and Cursor. The reporting also described sellers offering stolen AI access through underground channels.
That creates an important business risk.
The attacker who infects the endpoint does not necessarily need to personally use everything they steal.
The process can become:
Compromise the endpoint → collect credentials and tokens → package the access → sell or exploit it.
AI access is increasingly becoming part of that economy.
Yes.
Anthropic recently warned affected Claude customers that infostealer malware had stolen active Claude login sessions from their computers.
According to BleepingComputer, the infections included well-known infostealer families such as Vidar, LummaC2, StealC, RedLine and Acreed on Windows, along with Atomic Stealer on some Macs.
These malware families can collect information such as browser passwords, cookies and application credentials.
Attackers subsequently used stolen Claude sessions to consume victims’ paid AI usage. TechCrunch also documented cases in which compromised Claude session keys were used to generate unauthorized Claude Code OAuth tokens.
That changes the question defenders need to ask.
Instead of only asking:
“How do we stop someone from stealing the password?”
We also need to ask:
“What access already exists on this endpoint that an attacker could steal?”
Because MFA primarily protects the authentication event.
That remains extremely valuable.
But if malware compromises the endpoint after authentication, the endpoint may already contain the resulting session cookie, token or other authorization artifact.
An attacker who steals a usable artifact may be able to reuse it without going back through the original login process.
That is why businesses should avoid treating MFA as the final layer of endpoint security.
Identity protection and endpoint protection increasingly overlap.
Infostealers do not necessarily need to remain on a machine for days.
Their objective may be simple: get onto the endpoint, collect valuable information, exfiltrate it and leave.
Once a valid API key, token or authenticated session has left the machine, identifying the malware afterward does not necessarily undo the exposure.
And as malware becomes more polymorphic, evasive and AI-assisted, defenders cannot assume every new variant will be recognized before it acts.
That leads to a different security question:
What if you did not have to detect the attack in order to stop it?
In many cases, the objective should be to restrict the actions an attacker needs to perform, not to predict every possible piece of malware.
Changing the attack does not necessarily change the endpoint actions the attacker ultimately needs in order to succeed.
An infostealer may change its code, filename, delivery method or behavior from one attack to another.
But it may still need to access protected files, interact with applications, read sensitive data, reach memory, launch unauthorized processes or exfiltrate information.
That is where Isolation and Containment can complement Detect and Respond.
Instead of depending entirely on recognizing malicious code, Isolation and Containment can restrict what applications and processes are permitted to access or change.
The objective is not to predict every attack. It is to restrict the actions an attacker needs in order to succeed.
AppGuard is a proven endpoint protection solution with more than a decade of production history focused on prevention through Isolation and Containment.
It does not replace EDR, MFA, patching or other security controls.
Instead, AppGuard is designed to restrict unauthorized endpoint behavior without requiring the attack to first be identified as malicious.
That distinction becomes especially relevant with emerging infostealers.
The attack may be new. The actions it needs to perform on a Windows endpoint often are not.
AppGuard does not need to know the name of every infostealer to restrict endpoint behaviors the malware may require.
That can provide another layer of protection when detection is delayed, bypassed or dealing with malware it has never seen before.
Businesses and MSPs should assume that some threats will eventually evade detection.
That means protecting the identity layer is necessary, but not sufficient.
Continue using MFA. Continue patching. Continue using EDR and monitoring.
But also evaluate what happens if malware successfully reaches an endpoint.
Yesterday’s infostealer wanted the password.
Today’s infostealer may want the session, token, API key or AI access that the password helped create.
That was the central issue we explored in the September 23 episode of the CHIPS Cybersecurity Podcast, and these recent incidents reinforce why it matters.
As AI becomes connected to more business systems, the endpoint becomes an increasingly valuable collection point for attackers.
The question is no longer just whether an organization can detect an infostealer.
It is also:
If an unknown infostealer reaches the endpoint tomorrow, what prevents it from accessing what it came to steal?
You can listen to the CHIPS Cybersecurity Podcast for our September 23 discussion on how infostealers are expanding their targets to include AI credentials, API keys, session tokens and AI-agent data:
Listen to the CHIPS Cybersecurity Podcast on Spotify
Cloud Security Alliance, September 11, 2026
Stolen AI Session Tokens Are Bypassing MFA
VentureBeat, September 16, 2026
AI agents breached 395 organizations using credentials your IAM policy still treats as human
TechCrunch, September 8, 2026
Hackers are stealing Claude tokens from subscribers
BleepingComputer, August 30, 2026
Anthropic warns infostealer malware is hijacking Claude sessions to drain usage