Infostealers Expose AI Credentials Across 80,000+ Corporate Domains

Mon, 28 Sep 2026 18:35:17 +0000

Engineer — Plan: Shadow AI usage is creating an unmanaged credential surface; audit all AI API keys and service tokens in use, identify unauthorized AI tool adoption across the org, and enforce MFA on sanctioned AI platforms this quarter.
SOC/IR — Plan: Build or tune detections for infostealer activity on endpoints that may have accessed AI services, and add AI credential misuse (unexpected API spending, off-hours LLM calls) to your hunting checklist — no specific IOCs are provided but the campaign scale justifies coverage.
Leader — Plan: The breadth of exposed corporate domains signals a shadow-AI governance gap; prioritize an AI tool inventory and acceptable-use policy this quarter, and check whether your domain appears in dark-web credential feeds via your threat intel vendor.

Llmjacking on CuraSec