Criminal Hackers Add GenAI Credentials to Underground Markets

Researchers observed cybercriminal marketplaces selling stolen Generative AI account credentials (from services like ChatGPT, Quillbot, Notion, Huggingface, Replit)—typically harvested by infostealer malware—at a rate of roughly 400 accounts per day; sellers advertised items on underground services (e.g., LLM Paradise) and even leveraged social platforms. Threat actors monetize these credentials for phishing, malware deployment, building malicious chatbots, and exfiltrating sensitive corporate data; recommended mitigations include monitoring cloud GenAI usage, adopting passkeys/WebAuth, enforcing password best practices, and dark web monitoring.