Infostealers Are Selling Your Claude and ChatGPT Sessions for $5 on Telegram

Researchers at FlashPoint analyzed 44,791 stolen JWTs from a single infostealer log dump and found 555 tokens belonging to AI services including Claude, ChatGPT, Gemini, and Copilot, with 24 API keys still valid at the time of analysis. Working Claude Pro sessions were being sold on Telegram for as little as five dollars, and Anthropic warned affected users in early September 2026 that harvested session tokens were being replayed against production Claude accounts. The stolen tokens grant buyers full account access, including conversation history and enterprise-tier rate limits used for LLMjacking operations.

Researchers at FlashPoint analyzed 44,791 stolen JWTs from a single infostealer log dump last month. 555 of those tokens belonged to AI services. Claude, ChatGPT, Gemini, Copilot. Twenty-four of the API keys were still valid at the time of analysis. The going rate on Telegram for a working Claude Pro session? Five dollars. This is not a hypothetical attack vector. It is a live commodity market. The numbers come from a single aggregated stealer log, the kind that circulates on Telegram channels and dark web forums as compressed archives. Researchers parsed the full set and filtered for tokens matching known AI service JWT structures. Out of nearly 45,000 tokens, 555 were AI-specific. That is roughly 1.2% of all stolen session material targeting services that barely existed three years ago. The 24 valid API keys are the number that matters most. Each one of those keys grants the buyer full access to the victim's account. Not read-only. Full. They can query the API, read conversation history, upload documents, run agents, burn through usage credits. Some of the compromised keys had enterprise-tier rate limits attached, which makes them especially valuable for LLMjacking operations. Anthropic issued a warning to affected users in early September 2026. The advisory confirmed that session tokens harvested by browser-based infostealers were being sold and replayed against production Claude accounts. No vulnerability in Anthropic's infrastructure was involved. The tokens were stolen from the users' machines. The malware families doing this work are not new. Lumma, Vidar, StealC, Redline. These stealers have been pulling browser credentials, cookies, and autofill data for years. What changed is the target list. Modern infostealers run a structured extraction routine on every browser profile they find. They pull cookies from Chromium's encrypted cookie store using the DPAPI key they already have , harvest localStorage and sessionStorage databases, clone extension data directories, and scrape anything that looks like an API key from config files. AI service sessions are stored as JWTs in browser cookies or localStorage. The stealer grabs them along with everything else. The infection vector is usually a cracked software download, a fake CAPTCHA page that tricks users into running a PowerShell one-liner, or a malicious npm/PyPI package. The stealer runs for less than 30 seconds, exfiltrates everything to a C2, and sometimes deletes itself. The victim never sees a popup. Their Claude session keeps working normally because the token was copied, not revoked. Specialized tools like Camoufox and SeleniumBase replay kits let buyers load the stolen cookies into a browser fingerprint that matches the victim's original session. The AI service sees a request from what looks like the same browser, same TLS fingerprint, same cookies. No 2FA prompt fires because the session was already authenticated. A working Claude Pro or ChatGPT Plus session token gives the buyer several things. First: compute. An enterprise Claude account with the Opus 4.6 model available represents significant API value. LLMjacking operators buy stolen sessions specifically to run batch inference workloads, code generation pipelines, or data extraction jobs against the victim's usage limits. Sysdig's research team documented 5,871 compromised systems across 162 countries being used for LLMjacking operations in the first half of 2026 alone. The operators were burning through tens of thousands of dollars in API credits per compromised account. Second: data. Every conversation in that account is readable. If you used Claude to analyze contracts, draft legal documents, process medical records, or discuss proprietary code, the buyer now has all of it. Session tokens grant access to conversation history by default on every major AI platform. Third: identity. A compromised session can be used to interact with third-party integrations, MCP servers, or connected tools. If the victim's Claude account has access to their Slack workspace or Google Drive through MCP connectors, the attacker inherits that access. The $5 price point is not a floor. It is the bulk rate. Individual high-value sessions, ones with enterprise API access or interesting conversation histories, sell for more. The logs themselves circulate as datasets. Buyers filter for AI-service tokens the same way they filter for banking credentials. Sysdig coined the term LLMjacking to describe the use of stolen credentials to hijack large language model access. Their September 2026 report found that the practice has grown from a niche technique into a structured criminal economy. The 5,871 compromised systems they identified were spread across 162 countries. Attack infrastructure included dedicated proxy networks to distribute API calls across geographic regions, making rate-limit detection harder. Some operators ran automated pipelines that tested stolen tokens against multiple AI services simultaneously, categorized them by tier and rate limit, and listed the valid ones for resale within hours of the initial theft. The economic logic is simple. A Claude Max subscription costs $200/month. A stolen session token for that account costs $5 and works until the victim notices and rotates credentials. Most victims never notice. They see their usage dashboard tick up slightly, maybe, if they check at all. The stealer operator sells the same log to multiple buyers. The margin is enormous. Anthropic, OpenAI, and Google have all implemented some form of concurrent session detection. But the detection is tuned to avoid false positives from users who legitimately use multiple devices. An attacker who replays one session at a time, from a fingerprint that matches the victim's browser, rarely triggers it. The standard remediation advice is to rotate your API keys and clear your sessions. That works for the current compromise. It does nothing for the next one. If the infostealer is still on the machine, or if the user gets reinfected through the same vector, the new tokens get harvested within hours. The gap between compromise and detection averages weeks to months for credential theft. During that window, every new session token is exfiltrated as soon as it is issued. The real problem is architectural. AI services authenticate with long-lived session tokens stored in the browser. Those tokens are accessible to any process running with user-level permissions. No sandboxing. No hardware-backed credential storage. No mutual TLS. The token sits in a SQLite database on disk, encrypted with a key that any local process can derive. Hardware security keys protect the login flow. They do not protect the session token after login. You can have the strongest 2FA in the world, and a $30 infostealer will still grab the JWT out of your cookie store after you authenticate. Short-lived tokens with aggressive rotation would help. So would binding tokens to device attestation so they cannot be replayed from a different machine. Some platforms are moving in this direction. None have shipped it at scale for consumer accounts as of September 2026. For work that genuinely cannot tolerate session compromise, the only structural fix is to remove the cloud dependency entirely. Local inference on air-gapped hardware eliminates the token theft vector because there is no token. The model runs on your machine. No session cookie exists to steal. This used to be impractical. Running capable models locally required GPU clusters that most practitioners did not have access to. That changed with quantized models like DeepSeek R1 and Llama 3.3 running acceptably on consumer hardware. An M-series MacBook or a workstation with a 24GB GPU can run a 70B-parameter model at usable speeds for most development and analysis tasks. The tradeoff is capability. Local models are not Claude Opus. They are not GPT-4o. For many security research workflows, code analysis tasks, and documentation projects, they are good enough. And "good enough with zero exfiltration risk" beats "best-in-class with your session token on sale for $5" in any threat model that takes credential theft seriously. The question is not whether to use cloud AI. It is whether to use it for everything, including the work that an infostealer on your machine would make catastrophic. If you want a structured setup for running AI agents locally without cloud token exposure, I put together a 120-page guide at numbpilled.gumroad.com/l/ggwux https://numbpilled.gumroad.com/l/ggwux . Air-gapped DeepSeek R1 and Ollama stacks with 120+ prompt templates, no subscriptions required.