Infostealer zararli dasturi AI dasturchi muhitlariga kengaymoqda va parolni qayta o'rnatgandan keyin ham ruxsatsiz kirishni saqlab qoladigan autentifikatsiya fayllarini o'g'irlamoqda.
SpyCloud 2026-yil avgustidan beri 130 000 dan ortiq noyob WardenStealer infeksiyalarini qayta qo'lga kiritganini xabar qilmoqda.
Topilmalar tovar darajasidagi hisob ma'lumotlari o'g'irlanishining kengayishini tasvirlaydi, AI modellaridagi zaiflikni emas: hujumchilar oxirgi nuqtalarni buzib kiradi, so'ngra bashorat qilinadigan ilova kataloglaridan qimmatli sirlarni yig'adi.
Gen Digital mustaqil ravishda bu kengroq o'zgarishni bir nechta infostealer oilalari bo'yicha hujjatlashtirgan.
WardenStealer — Rust asosidagi Windows infostealer bo'lib, xizmat sifatida sotiladi — AI ilova ma'lumotlarini an'anaviy brauzer hisob ma'lumotlari, kriptovalyuta ma'lumotlari va xabar almashish hisoblari bilan birga paketlaydi.
SpyCloud qayta tiklangan jurnallarda Claude Code kirish va yangilash tokenlari, ulangan Model Context Protocol hisob ma'lumotlari, hisob sozlamalari va CLAUDE.md ko'rsatmalarini kuzatgan.
SpyCloud tomonidan vaqt o'tishi bilan qayta qo'lga kiritilgan noyob WardenStealer infeksiyalari soni (Manba: SpyCloud).
SpyCloud tadqiqotchilari WardenStealer va Aoki Claude Code, Codex, Cursor, GitHub Copilot va ish stoli AI ilovalari bilan bog'liq sessiya cookie-fayllari, OAuth tokenlari, API kalitlari va konfiguratsiya fayllarini yig'ayotganini aniqladi.
AI Sessiyalari O'g'irlangan
Codex to'plamlari API kalitlari va OAuth tokenlarini o'z ichiga olgan autentifikatsiya materialini o'z ichiga olgan. Bu artefaktlar obunadan ko'proq narsani ochib beradi: ruxsatlar va konfiguratsiyaga qarab, ulangan xizmatlar buzilishni omborlar, bulut muhitlari va ishlab chiqish infratuzilmasiga kengaytirishi mumkin.
Telegram suhbatlari to'plami AI hisoblari, API kalitlari va sessiyalarni allaqachon narxlangan tovar sifatida ko'radigan bozorni ko'rsatadi, ular o'g'irlash, ulgurji va chakana savdo darajalariga tashkil etilgan.
Jinoyatchilarga o'g'irlangan AI API kalitlarini taqdim etadigan Telegram botidan misol xabar (Manba: SpyCloud).
Gen Digital o'g'irlangan konfiguratsiyalar har bir integratsiyani avtomatik ravishda ochib bermasligini ogohlantiradi.
Aoki yanada aniq tashkil etilgan yondashuvni qo'llaydi. Uning qayta tiklangan jurnallari ChatGPT, Claude Code, Claude Desktop, Codex, GitHub Copilot va Cursor uchun alohida to'plamlarga ega AI Sessions katalogini o'z ichiga oladi.
SpyCloud Go bilan kompilyatsiya qilingan Windows namunalarini %TEMP%\akg_ bilan boshlanadigan vaqtinchalik yo'llardan foydalanib, neihite[.]cc bilan aloqa qilayotganini aniqladi.
SpyCloud tomonidan vaqt o'tishi bilan qayta qo'lga kiritilgan noyob Aoki stealer infeksiyalari soni (Manba: SpyCloud).
Asosiy muammo bekor qilishdir. Parollar, sessiya cookie-fayllari, API kalitlari va OAuth tokenlari alohida autentifikatsiya artefaktlaridir.
Birini o'zgartirish boshqalarini majburiy ravishda bekor qilmaydi; kirish provayderning tugashi, bekor qilish va sessiya boshqaruvi nazoratiga bog'liq. Yangilash tokenlari almashtirish kirish tokenlarini olish orqali kirishni uzaytirishi mumkin.
Yaroqli sessiya cookie-faylini qayta ishlatadigan hujumchi odatda ko'p omilli autentifikatsiyani ishga tushiradigan yangi kirishdan qochishi mumkin.
Bu MFA-ni kriptografik jihatdan buzmaydi; u jabrlanuvchi allaqachon tugallagan autentifikatsiyani suiiste'mol qiladi. Anthropic avval infostealer orqali Claude hisobini suiiste'mol qilishga javoban ta'sirlangan sessiyalarni tugatish va saqlangan to'lov usullarini olib tashlash orqali javob bergan.
SpyCloudning yashirin bozor kuzatuvlari AI obunalari va API kreditlari 40% dan 91% gacha chegirmalar bilan reklama qilinayotganini ko'rsatadi.
Ulgurji xizmatlar yuklangan kalitlar uchun 35% gacha komissiyalarni taqdim etgan. Biroq, tadqiqotchilar har bir reklama qilingan hisob ma'lumotlari zararli dasturdan emas, balki fishing, ochiq sirlar yoki firibgar ro'yxatdan o'tishdan kelib chiqqanini aniqlay olmagan.
Bu bozorlar LLMjackingni qo'llab-quvvatlaydi, bunda ruxsatsiz foydalanuvchilar qonuniy mijozlarga hisoblangan xulosalar sig'imini iste'mol qiladi.
Sysdigning 2024-yil may oyidagi tekshiruvi Claude suiiste'moli to'rtta AWS mintaqasida eng yomon holatda kuniga 46 080 dollarni tashkil etishi mumkinligini baholagan.
Bu raqam kvota asosidagi baho edi, tasdiqlangan jabrlanuvchi hisob-fakturasi emas. Uning tadqiqoti shuningdek, asosiy hisob ma'lumotlarini yashirgan holda kirishni jamlaydigan teskari proksi-serverlarni ham tasvirlagan.
Javob beruvchilar AI hisob ma'lumotlarini har bir dasturchi oxirgi nuqta infostealer tekshiruvi qismi sifatida ko'rib chiqishi kerak.
Qurilmani tozalash va tozalashdan so'ng, ishonchli tizimdan foydalanib sessiyalarni bekor qiling, ochiq API kalitlari va integratsiya sirlarini aylantiring va OAuth ruxsatlarini ko'rib chiqing. G'ayrioddiy foydalanish, hisob-faktura o'sishi, notanish manba manzillari va ulangan xizmat faoliyatini tekshiring.
Nihoyat, o'g'irlangan so'rovlar, tarixlar va loyiha fayllarini maxfiy ma'lumotlar uchun baholang. Himoyalangan hisob ma'lumotlari saqlash, tor doiradagi ruxsatlar va qisqaroq muddatli tokenlarni afzal ko'ring.
Tiklanish o'g'irlangan kirish artefaktlarini bekor qilishni talab qiladi, faqat ularni dastlab o'rnatgan parolni o'zgartirish emas.
ANYRUN Sandboxni SOCingizga integratsiya qiling va kiber tahdidlarni ta'sirga yetguncha 21 daqiqa tezroq MTTR bilan to'xtating.
Infostealer malware is expanding into AI developer environments, harvesting authentication files that can preserve unauthorized access after a password reset.
SpyCloud reports recapturing more than 130,000 unique WardenStealer infections since August 2026.
The findings describe an expansion of commodity credential theft, not a vulnerability in AI models: attackers compromise endpoints, then collect valuable secrets from predictable application directories.
Gen Digital independently documented this broader shift across multiple infostealer families.
WardenStealer, a Rust-based Windows infostealer sold as a service, packages AI application data alongside conventional browser credentials, cryptocurrency information, and messaging accounts.
SpyCloud observed Claude Code access and refresh tokens, connected Model Context Protocol credentials, account configuration, and CLAUDE.md instructions in recovered logs.
Number of unique WardenStealer infections recaptured by SpyCloud over time (Source : SpyCloud).
SpyCloud researchers identified, WardenStealer and Aoki collecting session cookies, OAuth tokens, API keys, and configuration files associated with Claude Code, Codex, Cursor, GitHub Copilot, and desktop AI applications.
AI Sessions Hijacked
Codex collections included authentication material containing API keys and OAuth tokens. These artifacts expose more than subscriptions: depending on permissions and configuration, connected services can extend the compromise into repositories, cloud environments, and development infrastructure.
Telegram chatter collection shows a market that already treats AI accounts, API keys, and sessions as priced commodities, organized into the same harvesting, wholesale, and retail tiers.
Example message from a Telegram bot that surfaces stolen AI API keys to criminals (Source : SpyCloud).
Gen Digital cautions that stolen configurations do not automatically unlock every integration.
Aoki takes a more explicitly organized approach. Its recovered logs contain an AI Sessions directory with separate collections for ChatGPT, Claude Code, Claude Desktop, Codex, GitHub Copilot, and Cursor.
SpyCloud identified Go-compiled Windows samples using temporary paths beginning with %TEMP%\akg_ and communicating with neihite[.]cc.
Number of unique Aoki stealer infections recaptured by SpyCloud over time (Source : SpyCloud).
The central issue is revocation. Passwords, session cookies, API keys, and OAuth tokens are separate authentication artifacts.
Changing one does not necessarily invalidate the others; access depends on the provider’s expiration, revocation, and session-management controls. Refresh tokens may extend access by obtaining replacement access tokens.
An attacker replaying a valid session cookie may also avoid the fresh login that normally triggers multifactor authentication.
This does not break MFA cryptographically; it abuses authentication the victim already completed. Anthropic previously responded to infostealer-driven Claude account abuse by terminating affected sessions and removing saved payment methods.
SpyCloud’s underground-market observations show AI subscriptions and API credit advertised at discounts ranging from 40% to 91%.
Wholesale services offered suppliers commissions reaching 35% of billings for uploaded keys. However, researchers could not establish that every advertised credential originated from malware rather than phishing, exposed secrets, or fraudulent registrations.
These markets support LLMjacking, where unauthorized users consume inference capacity billed to legitimate customers.
Sysdig’s May 2024 investigation estimated that worst-case Claude abuse across four AWS regions could generate $46,080 daily.
That figure was a quota-based estimate, not a confirmed victim invoice. Its research also described reverse proxies that aggregate access while concealing underlying credentials.
Responders should treat AI credentials as part of every developer-endpoint infostealer investigation.
After containing and cleaning the device, use a trusted system to revoke sessions, rotate exposed API keys and integration secrets, and review OAuth grants. Investigate unusual usage, billing spikes, unfamiliar source addresses, and connected-service activity.
Finally, assess stolen prompts, histories, and project files for proprietary information. Prefer protected credential storage, narrowly scoped permissions, and shorter-lived tokens.
Recovery requires invalidating stolen access artifacts, not merely changing the password that originally established them.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.