Infostealers WardenStealer and Aoki Harvest AI Developer Tokens from Claude, Codex, Cursor and Copilot
SpyCloud reports recapturing over 130,000 unique WardenStealer infections since August 2026, with the Rust-based Windows infostealer-as-a-service now harvesting authentication artifacts from AI developer tools alongside traditional browser credentials, crypto wallets, and messaging accounts. Gen Digital independently confirmed a broader shift across multiple infostealer families toward targeting AI application data. The malware collects Claude Code access/refresh tokens, Model Context Protocol credentials, configuration files, and CLAUDE.md instructions, while WardenStealer and a second family called Aoki also target Codex, Cursor, GitHub Copilot, and desktop AI apps. The core risk is that these stolen tokens, cookies, and API keys persist independently of account passwords, meaning a password reset alone does not revoke access, potentially enabling continued intrusion into repositories, cloud environments, and development infrastructure. Underground markets are already pricing AI subscriptions and API credits at 40-91% discounts, supporting LLMjacking schemes where attackers consume inference capacity billed to victims.
Detalhes técnicos
Aoki organizes stolen data into a dedicated "AI Sessions" directory with separate collections per application (ChatGPT, Claude Code, Claude Desktop, Codex, GitHub Copilot, Cursor). SpyCloud identified Go-compiled Windows samples using temporary paths beginning with %TEMP%\akg_ that communicate with neihite[.]cc. Because passwords, session cookies, API keys, and OAuth tokens are distinct authentication artifacts, replaying a valid stolen session cookie can bypass the fresh-login MFA challenge without breaking MFA cryptographically. Refresh tokens can further extend attacker access by minting new access tokens. Sysdig's earlier research (May 2024) estimated worst-case Claude abuse across four AWS regions could generate up to $46,080/day via reverse proxies that conceal underlying credentials, though this was a quota-based estimate rather than a confirmed loss figure.
Remediação
Treat AI credentials as part of every developer-endpoint infostealer investigation. After containment and cleanup, use a trusted system to revoke sessions, rotate exposed API keys and integration secrets, and review OAuth grants. Investigate unusual usage patterns, billing spikes, unfamiliar source IPs, and connected-service activity. Assess stolen prompts, histories, and project files for exposed proprietary information. Prefer protected credential storage, narrowly scoped permissions, and shorter-lived tokens; recovery requires invalidating all stolen access artifacts, not just changing the originating password.
Linha do tempo
-
Infostealers WardenStealer and Aoki Harvest AI Developer Tokens from Claude, Codex, Cursor and Copilot
ler a análise desta fonte ocultar
SpyCloud reports recapturing over 130,000 unique WardenStealer infections since August 2026, with the Rust-based Windows infostealer-as-a-service now harvesting authentication artifacts from AI developer tools alongside traditional browser credentials, crypto wallets, and messaging accounts. Gen Digital independently confirmed a broader shift across multiple infostealer families toward targeting AI application data. The malware collects Claude Code access/refresh tokens, Model Context Protocol credentials, configuration files, and CLAUDE.md instructions, while WardenStealer and a second family called Aoki also target Codex, Cursor, GitHub Copilot, and desktop AI apps. The core risk is that these stolen tokens, cookies, and API keys persist independently of account passwords, meaning a password reset alone does not revoke access, potentially enabling continued intrusion into repositories, cloud environments, and development infrastructure. Underground markets are already pricing AI subscriptions and API credits at 40-91% discounts, supporting LLMjacking schemes where attackers consume inference capacity billed to victims.
Technical Details
Aoki organizes stolen data into a dedicated "AI Sessions" directory with separate collections per application (ChatGPT, Claude Code, Claude Desktop, Codex, GitHub Copilot, Cursor). SpyCloud identified Go-compiled Windows samples using temporary paths beginning with
%TEMP%\akg_that communicate withneihite[.]cc. Because passwords, session cookies, API keys, and OAuth tokens are distinct authentication artifacts, replaying a valid stolen session cookie can bypass the fresh-login MFA challenge without breaking MFA cryptographically. Refresh tokens can further extend attacker access by minting new access tokens. Sysdig's earlier research (May 2024) estimated worst-case Claude abuse across four AWS regions could generate up to $46,080/day via reverse proxies that conceal underlying credentials, though this was a quota-based estimate rather than a confirmed loss figure.Remediation
Treat AI credentials as part of every developer-endpoint infostealer investigation. After containment and cleanup, use a trusted system to revoke sessions, rotate exposed API keys and integration secrets, and review OAuth grants. Investigate unusual usage patterns, billing spikes, unfamiliar source IPs, and connected-service activity. Assess stolen prompts, histories, and project files for exposed proprietary information. Prefer protected credential storage, narrowly scoped permissions, and shorter-lived tokens; recovery requires invalidating all stolen access artifacts, not just changing the originating password.