The original text is in EN, taken from the source site. Source ↗

Infostealer malware is expanding into AI developer environments, harvesting authentication files that can preserve unauthorized access after a password reset.

SpyCloud reports recapturing more than 130,000 unique WardenStealer infections since August 2026.

The findings describe an expansion of commodity credential theft, not a vulnerability in AI models: attackers compromise endpoints, then collect valuable secrets from predictable application directories.

Gen Digital independently documented this broader shift across multiple infostealer families.

WardenStealer, a Rust-based Windows infostealer sold as a service, packages AI application data alongside conventional browser credentials, cryptocurrency information, and messaging accounts.

SpyCloud observed Claude Code access and refresh tokens, connected Model Context Protocol credentials, account configuration, and CLAUDE.md instructions in recovered logs.

Number of unique WardenStealer infections recaptured by SpyCloud over time (Source : SpyCloud).

SpyCloud researchers identified, WardenStealer and Aoki collecting session cookies, OAuth tokens, API keys, and configuration files associated with Claude Code, Codex, Cursor, GitHub Copilot, and desktop AI applications.

AI Sessions Hijacked

Codex collections included authentication material containing API keys and OAuth tokens. These artifacts expose more than subscriptions: depending on permissions and configuration, connected services can extend the compromise into repositories, cloud environments, and development infrastructure.

Telegram chatter collection shows a market that already treats AI accounts, API keys, and sessions as priced commodities, organized into the same harvesting, wholesale, and retail tiers.

Example message from a Telegram bot that surfaces stolen AI API keys to criminals (Source : SpyCloud).

Gen Digital cautions that stolen configurations do not automatically unlock every integration.

Aoki takes a more explicitly organized approach. Its recovered logs contain an AI Sessions directory with separate collections for ChatGPT, Claude Code, Claude Desktop, Codex, GitHub Copilot, and Cursor.

SpyCloud identified Go-compiled Windows samples using temporary paths beginning with %TEMP%\akg_ and communicating with neihite[.]cc.

Number of unique Aoki stealer infections recaptured by SpyCloud over time (Source : SpyCloud).

The central issue is revocation. Passwords, session cookies, API keys, and OAuth tokens are separate authentication artifacts.

Changing one does not necessarily invalidate the others; access depends on the provider’s expiration, revocation, and session-management controls. Refresh tokens may extend access by obtaining replacement access tokens.

An attacker replaying a valid session cookie may also avoid the fresh login that normally triggers multifactor authentication.

This does not break MFA cryptographically; it abuses authentication the victim already completed. Anthropic previously responded to infostealer-driven Claude account abuse by terminating affected sessions and removing saved payment methods.

SpyCloud’s underground-market observations show AI subscriptions and API credit advertised at discounts ranging from 40% to 91%.

Wholesale services offered suppliers commissions reaching 35% of billings for uploaded keys. However, researchers could not establish that every advertised credential originated from malware rather than phishing, exposed secrets, or fraudulent registrations.

These markets support LLMjacking, where unauthorized users consume inference capacity billed to legitimate customers.

Sysdig’s May 2024 investigation estimated that worst-case Claude abuse across four AWS regions could generate $46,080 daily.

That figure was a quota-based estimate, not a confirmed victim invoice. Its research also described reverse proxies that aggregate access while concealing underlying credentials.

Responders should treat AI credentials as part of every developer-endpoint infostealer investigation.

After containing and cleaning the device, use a trusted system to revoke sessions, rotate exposed API keys and integration secrets, and review OAuth grants. Investigate unusual usage, billing spikes, unfamiliar source addresses, and connected-service activity.

Finally, assess stolen prompts, histories, and project files for proprietary information. Prefer protected credential storage, narrowly scoped permissions, and shorter-lived tokens.

Recovery requires invalidating stolen access artifacts, not merely changing the password that originally established them.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.