Between September 8 and 10, stolen machine credentials breached 395 organizations across 48 countries. Okta flagged a Telegram infostealer dump containing 5,871 infected machines across 162 countries and unexpired tokens for Google, Microsoft, Anthropic, Amazon, and Cursor that bypass MFA. Telegram