Over the past year, more than 100,000 OpenAI ChatGPT account credentials have been stolen by information stealer malware and posted to elicit marketplaces on the dark web. These credentials were discovered within information stealer logs that can be found for sale on underground cybercrime sites. Leaked ChatGPT credentials peaked in May 2023, with threat actors posting roughly 26,800 new credential pairs. Within the last year, info-stealer logs with ChatPGT credentials have most heavily targeted the Asian-Pacific region, having seen 41,000 compromised accounts. India accounted for 12,632 of those Asian-Pacific accounts and was the largest targeted country. Additional heavily hit countries include Pakistan, Brazil, Vietnam, Egypt, and the United States. Researchers found that the Racoon stealer consisted of 80% of all stolen ChatGPT logs, Vidar with 13%, and Redline with 7%. With ChatGPT’s inherent retainer of user conversations, threat actors who obtain account credentials may find troves of sensitive information as more enterprises continue to integrate ChatGPT into their operational flows and individual users continue to leverage the AI-powered tool to work on propriety software code, internal business strategies, or classified correspondence. Overall, information-stealer malwares have become a popular tool amongst cybercriminals, having the ability to hijack passwords, cookies, credit cards, and other account data stored on applications such as email clients, web browsers, instant messengers, gaming services, cryptocurrency wallets, and more. CTIX analysts recommend users secure their accounts with two-factor authentication to prevent account takeover attacks and consider turning off ChatGPT’s standard configuration that retains conversations.