Attackers are breaking into AI accounts to use the computing power, not to raid your files. Info stealer malware lifts the login session out of an infected computer’s browser, the attacker signs in as you, and then they run their own work on your account until your bill goes up.
Your CRM and your bank sitting inside that account aren’t the target. The usage is the target. I covered this on Businessing with Pat Miller, and here’s what a business owner needs to know.
Why would anybody want my AI account?
When I first heard about this one, my mind went straight to the scary version. My AI is connected to my CRM and my bank, so they’ll get in there and take everything. That’s not what they’re doing, and that’s what made me stop and go, “huh.”
They want the tokens, the compute, the thing you pay for every month. They get into an account, they use it for whatever they’re doing, and you pay for it. It’s like somebody running an extension cord to the outlet on the side of your house so they can soak up your electricity. Nothing gets stolen off your shelves. You just get the bill. It’s a new world, and it’s worth knowing about before it shows up on your statement.
How do hackers get into an AI account?
Through your browser, on a computer that already has something bad on it. Info stealer malware sits on an infected machine and lifts the browser session, which includes the access token that keeps you logged in to your AI account. With that token, the attacker doesn’t need your password and doesn’t have to beat two-factor. They’re already holding a key that says you are you.
That’s why the fix isn’t a stronger password. The fix is keeping the malware off the machine in the first place, and knowing the handful of moves that put it there. Those moves are boring and familiar, and they keep working anyway because people are rushed and distracted, and rushed and distracted is most of a business owner’s week.
How do I keep my AI account from getting stolen?
Four habits cover almost all of it. First, never download an off-brand or cracked version of software you should be paying for. I came from the Napster generation, so I understand the temptation, but those cracked downloads are one of the main ways this malware travels. Second, never update an app from a website. If a page pops up offering to update your software, close it and update inside the software itself or through the official app store.
Third, never run a command a website tells you to run. Some of these show up dressed as an “are you a real human” check. Instead of picking out the bicycles, it asks you to paste something into your computer to continue. That’s not a security check. That’s the attack. Fourth, don’t install browser extensions you don’t recognize. An extension has direct access to your browser and often to a lot of what’s stored in it.
How would I know if my AI account was already hacked?
Watch your usage. Every so often, open your AI tools and look at how much you’ve used. If your usage spikes in a week when you barely touched it, something is wrong and it’s worth chasing down right then. Sign out of every device, change the password, and look at what else that account is connected to.
Usage is the tell because usage is the point of the whole attack. A data thief tries to stay hidden. Somebody burning your compute can’t hide, because the meter runs. Checking once a week takes about a minute, and it’s the earliest warning you’re going to get.
Questions owners ask
Why are hackers stealing AI accounts?
For the computing usage. They use the account’s paid capacity to run their own work, and the account owner gets the bill.
Is my data safe if somebody gets into my AI account?
Treat any break-in as a data risk regardless of what the attacker was after. In the cases going around, the goal is the usage, but an account with your files and connected tools in it should be locked down and reviewed the moment anything looks off.
What is info stealer malware?
Software that sits on an infected computer and lifts saved logins and active browser sessions. Because it takes the session, it can get past a password and past two-factor.
Will a stronger password stop this?
Not on its own. The attacker is taking the session out of the browser rather than guessing the password, so keeping the malware off the machine matters more than password strength.
Here’s the homework, and it takes ten minutes. Open your AI account and look at the usage. Open your browser extensions and delete anything you don’t recognize or don’t use anymore. Then say out loud to anybody else who touches a computer in your business that nobody updates software from a website and nobody runs a command a website asks them to run. That’s the whole defense, and the best time to do it is before the bill shows up. Watch the full episode for the rest of the conversation.