SOCRadar Report Finds Stolen AI Credentials Across 80,000+ Corporate Domains

Summary

SOCRadar’s report analyzed infostealer records tied to more than 80,000 corporate domains, highlighting exposed AI accounts, sessions and API keys, and recommending stronger identity controls and monitoring.

Key points

SOCRadar says it analyzed more than one million infostealer records tied to AI services across 80,000-plus corporate domains, then focused on 482 established enterprises.
The report identified 5,434 stealer-log records linked to 1,500 corporate email addresses across those 482 organizations; 295 had records surfaced in the prior 90 days.
Captured ChatGPT or OpenAI sessions appeared for 358 companies and accounted for roughly 90% of the records in the study. The report attributes this concentration partly to broader employee adoption, not a verdict on vendor security.
The article says stolen AI sessions can expose conversation histories and bypass password-based authentication; exposed automation sessions or API keys may also enable misuse and unauthorized charges.
Technology and internet-services firms were the largest sector in the study, while the report also found exposure across industries including healthcare, finance, retail and energy.
Recommended steps include putting AI services behind SSO with short-lived sessions, scoping and rotating API keys, monitoring for session-token reuse, and identifying employee accounts in stealer logs.

Article Details

Publisher: SOCRadar
Report Period: 2026; includes records surfaced in the 90 days before the report
Scope: Infostealer records associated with AI services and corporate domains, narrowed to 482 established enterprises across 36 countries and eight sectors.
Sample Size: More than 1 million initial infostealer records; the analysis focused on 482 enterprises and 5,434 stealer-log records tied to 1,500 distinct corporate email addresses.
Key Statistics: Of the 482 enterprises analyzed, 68% were billion-dollar organizations.
ChatGPT or OpenAI sessions appeared for 358 of the 482 companies; those companies accounted for roughly 90% of the study's records.
295 of the 482 companies had records that surfaced in the 90 days before the report.
Technology and internet-services firms represented 144 companies and 40% of all records.
LLM-platform exposure was highest in energy, affecting 93% of affected companies in that sector.
Recommendations: Put AI platforms behind SSO and use short-lived sessions with OAuth 2.0/OIDC refresh-token rotation.
Scope, cap, and rotate API keys; alert on usage from unfamiliar ASNs or at unusual hours.
Monitor for session-token reuse, including changes in country or device fingerprint during a session.
Treat employees appearing in stealer logs as endpoint incidents, not merely password-reset cases.
Identify corporate domains appearing in stealer logs to discover shadow AI accounts.