Session tokens for AI services are now on the target list. This week brought the first confirmed infostealer campaign harvesting Claude session credentials, a governance gap exposed by Anthropic’s own compliance tooling, and a voice-phishing campaign that turns Microsoft Teams into the initial access vector for domain controller compromise. Three stories, one throughline: identity is the attack surface — whether the identity belongs to a human, an AI agent, or a network router.

In the News

Infostealers Now Hijack Claude AI Sessions to Drain Usage Quotas

Anthropic confirmed that infostealer malware is actively harvesting Claude session tokens from infected developer machines. The mechanism is not novel — it is the same browser cookie theft that has plagued SaaS platforms for years — but the target is new. Attackers who obtain a valid Claude session token can impersonate the legitimate user, consume their API usage quotas, and potentially access conversation history that may contain proprietary code, internal documents, or credentials pasted into prompts.

The campaign represents a meaningful inflection point for AI identity security. Every organization deploying AI coding assistants has effectively created a new class of session-based identity that inherits the human user’s access and trust. If the session is not bound to the device — if it is a replayable token stored in a browser profile or local config file — then it is exfiltrable by any infostealer that can read the filesystem.

The primary countermeasure is device-bound session credentials. FIDO2-based authentication ties the session to the hardware, making a stolen token useless on another device. Identity threat detection and response (ITDR) provides the detection layer: a Claude account suddenly authenticating from a different geography, device fingerprint, or IP range is a high-fidelity anomaly signal.

What defenders should do: Audit how AI service sessions are authenticated across your developer population. If sessions are cookie-based or token-based without device binding, treat them as high-value credential targets. Deploy phishing-resistant passwordless authentication (FIDO2) where the AI vendor supports it, and implement ITDR to detect session anomalies.

MITRE ATT&CK: T1539 (Steal Web Session Cookie), T1078 (Valid Accounts)

Source: BleepingComputer

Claude Code’s Compliance API Exposes the AI Agent Governance Gap

Anthropic shipped a Compliance API for Claude Code — the AI agent that reads files, runs shell commands, and operates through the developer’s own credentials. The API gives security teams activity logs: what the agent accessed, what commands it executed, what files it read. This is a meaningful step forward for visibility.

It is not, however, governance. Logs tell you what happened after the fact. They cannot answer the preventive question: should this agent have been authorized to access that resource in the first place? Claude Code inherits whatever permissions the developer has. If the developer can read production secrets, so can the agent. If the developer can run admin-level commands, so can the agent. There is no separate entitlement layer for the AI identity.

This is the non-human identity (NHI) governance conversation that security teams need to have now. AI agents are not humans, and they should not inherit blanket human entitlements. They need distinct identity objects with scoped permissions, activity baselines, and anomaly detection — the same governance framework that mature organizations apply to service accounts and API keys.

What defenders should do: Treat AI coding assistants as non-human identities requiring separate entitlement policies. Implement least-privilege scoping for what the agent can access (distinct from what the developer can access). Use the Compliance API for detection, but do not confuse logging with authorization control.

Source: The Hacker News

Spring Ring Campaign Weaponizes Teams Voice Phishing Against Domain Controllers

Palo Alto’s Unit 42 documented the “Spring Ring” campaign, which abuses Microsoft Teams external-access federation to initiate voice-phishing calls. Attackers contact victims through Teams — appearing as legitimate external contacts — and socially engineer them into installing malware. The end target is domain controllers.

The attack chain is worth understanding step by step. Teams external access allows users from outside the organization to initiate communication by default. The attacker uses a compromised or purpose-built tenant to place voice calls. During the call, the victim is convinced to execute a payload — often framed as a troubleshooting tool or remote-support agent. Once on the endpoint, the malware targets Active Directory domain controllers, harvesting credentials and establishing persistence.

This is the “trusted collaboration platform becomes the attack vector” pattern. Traditional MFA does not help here because the social engineering happens over voice — the attacker talks the victim through the authentication step. Phishing-resistant passwordless authentication (FIDO2) eliminates this vector because there is nothing to verbally hand over. There is no code, no push notification, no one-time password — just a hardware-bound cryptographic assertion.

What defenders should do: Restrict Microsoft Teams external access to approved domains. Deploy phishing-resistant passwordless authentication (FIDO2) for all accounts with privileged access to domain controllers. Implement ITDR to detect anomalous authentication patterns against domain controllers, and enforce network segmentation that limits what a compromised endpoint can reach.

MITRE ATT&CK: T1566.004 (Phishing: Spearphishing Voice), T1078 (Valid Accounts), T1003 (OS Credential Dumping)

Source: Unit 42

Threat Pulse

Fire Ant Harvests TACACS Credentials from Cisco Routers. China-linked Fire Ant expanded from VMware hypervisors to Cisco IOS XR routers and TACACS servers — stealing the credentials that authenticate and authorize network infrastructure administration, then blinding security logs. This is infrastructure-layer identity theft: when the identity system governing routing and admin access is compromised, every control built on top of it fails. Encrypt TACACS+ transport, segment management planes, and deploy ITDR against network infrastructure authentication. (The Hacker News)

TerminalFix Runs AD Reconnaissance Through Fake CAPTCHAs. Microsoft documented the TerminalFix campaign, a ClickFix variant that tricks users into running PowerShell via fake Cloudflare verification prompts. The payload deploys DLL sideloading and steganographic payloads, then conducts extensive Active Directory reconnaissance — enumerating domain trusts, privileged accounts, and delegation settings to map identity infrastructure for lateral movement. (Microsoft Security Blog)

Aurora Ransomware Operators Use Cursor AI for Live Attack Automation. Russian-speaking Aurora operators are using the Cursor AI coding assistant not just for malware development but for real-time attack automation during intrusions — the first confirmed case of threat actors deploying AI dev tools for live penetration. (The Hacker News)

Defender Action Items

  • Audit AI session token storage. Identify where Claude, Copilot, Cursor, and other AI assistant session tokens are stored on developer machines. If they are replayable browser cookies or config-file tokens, they are infostealer targets. Deploy device-bound credentials (FIDO2) where supported.
  • Restrict Microsoft Teams external federation. Disable external access or restrict it to approved tenant domains. Monitor for voice calls originating from external tenants to privileged users.
  • Harden TACACS+ infrastructure. Encrypt all TACACS+ transport, segment management-plane traffic from production networks, and monitor for anomalous authentication to network infrastructure devices.
  • Deploy phishing-resistant passwordless authentication for privileged accounts. MFA fatigue and voice phishing both bypass traditional MFA. FIDO2-based passwordless is the countermeasure — there is nothing to socially engineer.
  • Treat AI agents as non-human identities. Do not let AI coding assistants inherit developer entitlements by default. Scope agent permissions separately and baseline their activity patterns for anomaly detection.

Detection Queries

Detect anomalous session reuse for AI services — look for the same session token authenticating from multiple IP addresses or geographies within a short window. This KQL query targets sign-in logs where session identifiers appear across distinct IPs:

SigninLogs
| where AppDisplayName has_any ("Claude", "Anthropic", "Cursor", "Copilot")
| summarize DistinctIPs = dcount(IPAddress), IPs = make_set(IPAddress), MinTime = min(TimeGenerated), MaxTime = max(TimeGenerated) by SessionId, UserPrincipalName
| where DistinctIPs > 1
| where (MaxTime - MinTime) < 1h
| project UserPrincipalName, SessionId, DistinctIPs, IPs, MinTime, MaxTime

This query surfaces sessions that appear from multiple source IPs within one hour — a high-fidelity indicator of token theft and replay. Tune the time window and IP threshold based on your environment’s VPN and proxy topology.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) — Human, machine, and AI identity security — NHI, ITDR, and the IAM market.