Full Report
Kela researchers explain that infostealers are to blame for compromised OpenAI logins
Analysis Summary
This is a summary based *only* on the provided text fragment, which details a debunked claim of an OpenAI breach.
# Incident Report: Debunked Claim of OpenAI Credential Sale
## Executive Summary
Threat intelligence firm Kela investigated a threat actor's claim regarding the sale of tens of millions of OpenAI account logins. Kela determined that the actor, "emirking," likely sourced these credentials from publicly and privately available infostealer logs rather than an actual breach of OpenAI's systems. The investigation traced the sample credentials back to widespread credential stuffing/collection sources.
## Incident Details
- **Discovery Date:** February 11, 2025 (Date of Kela report/analysis publication)
- **Incident Date:** Claim posted on February 6, 2025 (Threat actor advertisement)
- **Affected Organization:** OpenAI (Claimed target, later refuted)
- **Sector:** Technology/AI Services
- **Geography:** Not specified (Threat actor activity appears global based on infostealer sources)
## Timeline of Events
### Initial Access (Source of Sale Data)
- **Date/Time (Actor Post):** February 6, 2025 (Threat actor "emirking" advertises credentials)
- **Vector:** Claimed breach; **Actual Vector:** Infostealer malware logs (Crimeware)
- **Details:** A sample of 30 credentials related to `auth0.openai.com` was shared by the actor for verification.
### Lateral Movement
- Not applicable; this event concerns credential sales based on prior compromise of *users*, not lateral movement within OpenAI's core infrastructure.
### Data Exfiltration/Impact
- **Impact:** The *claim* threatened the exposure of up to 20 million OpenAI account logins. The actual impact on OpenAI systems was determined to be nil. The impact on users is credential reuse for other services.
### Detection & Response
- **How it was discovered:** Threat intelligence firm Kela analyzed a sample shared by the threat actor.
- **Response actions taken:** Kela cross-referenced the sample credentials against their data lake of compromised accounts derived from infostealer malware, successfully tracing the source and invalidating the breach claim.
## Attack Methodology
- **Initial Access (of end-users):** Infostealer malware (Redline, RisePro, StealC, Lumma, Vidar).
- **Persistence:** Not applicable to the primary finding.
- **Privilege Escalation:** Not applicable.
- **Defense Evasion:** Not applicable (The malware successfully evaded user detection).
- **Credential Access (of end-users):** Infection by infostealer malware capturing saved credentials or browser sessions.
- **Discovery:** Threat actor "emirking" advertised the collected credentials on BreachForums.
- **Lateral Movement:** Not applicable.
- **Collection:** Infostealers collected authentication details pointing to `auth0.openai.com`.
- **Exfiltration:** Credentials were sold/advertised for sale.
- **Impact:** Deception regarding a major breach; potential credential stuffing attacks against users.
## Impact Assessment
- **Financial:** Not specified.
- **Data Breach:** 20 million alleged OpenAI credentials (later determined to be third-party collected). Credentials traced to 14 discrete sources, some linked to malware infections between October 2023 and July 2024.
- **Operational:** No confirmed operational disruption to OpenAI was found.
- **Reputational:** Brief, unfounded negative reputational risk incurred by the *claim* of a breach.
## Indicators of Compromise
- **Network Indicators:** Threat actor pseudonym: `emirking`
- **File Indicators:** Malware families associated with the source of credentials: Redline, RisePro, StealC, Lumma, Vidar.
- **Behavioral Indicators:** Sale of credentials related to `auth0.openai.com` on underground forums (BreachForums).
## Response Actions
- **Containment measures:** Kela analyzed the sample to confirm the scope and authenticity of the claim.
- **Eradication steps:** Not applicable to the alleged breach, but the finding effectively eradicated the narrative of a successful OpenAI intrusion.
- **Recovery actions:** Not applicable to OpenAI core systems.
## Lessons Learned
- **Key takeaways:** Threat actors often rely on large caches of credentials harvested via widespread commodity malware (infostealers) and falsely attribute them to specific high-profile breaches to generate sales.
- **What could have been done better:** Victims whose credentials were stolen by infostealers should prioritize password changes across all services, especially where email reuse is common (23 out of 28 analyzed samples showed email reuse).
## Recommendations
- **Prevention measures for similar incidents:** Implement mandatory Multi-Factor Authentication (MFA) across all high-value services like OpenAI. Organizations should monitor underground forums for actors falsely claiming access to their infrastructure. Users must recognize that credentials derived from infostealer logs are a primary source of illicit credential sales.