[lumma]

September 11, 2026

• Infostealer logs are yielding replayable AI session tokens — Lumma and Vidar output is being mined for provider tokens and API keys that grant account access without touching the password or MFA (The Hacker News). · AI Infrastructure & Agent Security

in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign

September 1, 2026

• Anthropic is force-logging-out Claude users and stripping stored payment data after commodity infostealers were found harvesting authenticated Claude sessions and replaying them to consume victims' usage; Anthropic says the activity is unrelated to malware distributed through Claude (SecurityWeek, Dark Reading). As @Privacy_Hawk puts it, stealers like Vidar, Lumma and StealC don't need the password if they can lift an already-authenticated browser session (earlier coverage). · AI & Model Security

in Attackers Are Living in the Management Plane