A newly identified infostealer hijacks victims' Uber Eats sessions to read their order histories, then uses Claude Opus to estimate how valuable that data is, according to a report citing Cisco Talos.
Infostealer · Session hijacking · AI triage
A new infostealer turns Uber Eats sessions into targeting data
The malware takes over active logins rather than only saved passwords, reads order histories, confirms addresses from Gmail receipts, and sends the results to Claude Opus to rank how valuable each victim's records are.
How the attack chain works
Four stages, from a stolen session to a ranked list of targets
STEP 1
Hijack session
Takes over an active Uber Eats login, not just saved passwords
→
STEP 2
Read order history
Pulls the victim's past Uber Eats orders from the account
→
STEP 3
Scan email receipts
Searches Gmail for delivery receipts that can confirm a home address
→
STEP 4
AI ranks the value
Claude Opus is asked to rate how useful or sensitive each victim's records are
Why it matters
Session hijacking can bypass some password protections
Order histories plus email receipts can help attackers profile and locate people
Routine consumer data becomes a targeting asset
Using a commercial AI model to triage stolen data lowers the effort needed to choose victims
What can be done
For consumers
Sign out of shared devices
Enable multi-factor authentication
Review active sessions regularly
Watch for unexpected delivery or account activity
For platforms
Shorten session lifetimes
Detect unusual access patterns faster
The bigger shift
Infostealers are moving from bulk credential theft to targeted profiling.
Bypass
Live sessions can get around some password protections.
Combine
Ordinary purchase and email data is linked into a profile of a person.
Triage
AI helps decide which victims are worth targeting.
Open questions
The reporting so far does not answer these points.
How the malware is distributed
How many accounts or infections are affected
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...