Infostealer malware is expanding its reach, now targeting not only passwords saved in browsers, but also AI accounts and developer tools. WardenStealer and Aoki viruses collect cookies, OAuth tokens, API keys, and configuration files, allowing cybercriminals to gain access to victims’ accounts by bypassing the re-authorization process.
Infostealer malware is expanding its reach, now targeting not only passwords saved in browsers, but also AI accounts and developer tools. WardenStealer and Aoki viruses collect cookies, OAuth tokens, API keys, and configuration files, allowing cybercriminals to gain access to victims’ accounts by bypassing the re-authorization process.
According to research by SpyCloud, the targets of the attackers were Claude Code, OpenAI Codex, Cursor, GitHub Copilot, as well as the desktop applications Claude and ChatGPT, writes Cyber Press.
SpyCloud experts reported the detection of logs from over 130,000 unique cases of WardenStealer infection since August 2026. At the same time, the exploit does not use new vulnerabilities in the AI model itself - the malware, once on the victim's computer, simply copies valuable files from the intended system directories. Independent research by Gen Digital also confirms this large-scale shift towards stealing AI credentials, correspondence history and project information.
WardenStealer is a Windows malware written in Rust that is distributed via model subscriptions on the darknet. SpyCloud first detected it on August 3, 2026. The program collects credentials from browsers, crypto wallets, instant messengers, remote access tools, and AI software. The stolen Claude Code files contained OAuth access tokens, account credentials, and credentials for connected Model Context Protocol (MCP) servers that connect AI assistants to external databases and tools.
Aoki is another Windows virus (written in Go) spotted by SpyCloud on October 4, 2026. It stores stolen AI data in a separate AISessions folder with subfolders for ChatGPT, Claude Code, Claude Desktop, Codex, Copilot, and Cursor.
The main risk is session hijacking. A valid stolen cookie allows an attacker to continue an authorized session without entering a password or going through two-factor authentication.
Additionally, token theft fuels the underground market:
Criminals are selling AI subscriptions and API access at discounts ranging from 40% to 91%;
the phenomenon of LLMjacking arises - the use of someone else's paid AI resources for one's own purposes. Sysdig research (May 2024) shows that a worst-case scenario of unauthorized use of Claude in multiple regions could cost an organization over $46,000 per day;
Stolen configurations and prompt history can reveal development source code, internal systems, or corporate secrets.
Experts urge cybersecurity professionals to be sure to check AI applications when investigating incidents on developer workstations.
If you suspect a compromise, you must use a secure device to:
end all active account sessions;
change (rotate) all API keys and OAuth credentials;
check and update MCP connections;
analyze resource usage logs for abnormal spending of limits or funds.
