Claude and ChatGPT sessions sold for $5 on Telegram after infostealer theft

FlashPoint analyzed 44,791 stolen JWTs from a single infostealer log dump: 555 tokens belonged to AI services including Claude, ChatGPT, Gemini and Copilot, and 24 API keys were still valid. Anthropic warned affected users in September 2026 that session tokens were harvested from user machines and resold for LLMjacking.

• Only 555 of 44,791 JWTs (about 1.2%) belonged to AI services
• 24 API keys were still valid at the time of analysis
• A working Claude Pro session sells for $5 on Telegram
• Sysdig found 5,871 compromised systems across 162 countries used for LLMjacking