Hackers are expanding information theft beyond saved passwords, targeting authentication tokens and session data stored by ChatGPT, Claude, Codex, and other AI tools.
Two Windows malware families, WardenStealer and Aoki, collect credentials that may remain usable after a password reset, leaving victims exposed even after they believe their accounts are secured.
The danger extends beyond unauthorized chatbot access. Developers often connect AI assistants to source repositories, cloud services, and build pipelines.
Stolen credentials and configuration files can expose those connections, while valid sessions let criminals act as authenticated users without repeating the normal login process or facing a fresh multifactor authentication challenge.
Researchers from SpyCloud identified this activity by examining recovered infection logs, rather than relying only on malware advertisements or code analysis.
In its October 30 research report, the company reported more than 130,000 unique WardenStealer infections since first observing the family on August 3, 2026.
Hackers Use New Infostealer Malware
WardenStealer is a Rust-based Windows infostealer sold through a malware-as-a-service model. Alongside browser passwords, cookies, messaging data, and cryptocurrency information, it collects files belonging to locally installed AI applications.
Earlier reporting on Warden Stealer distribution methods described ClickFix lures, malicious advertisements, cracked software, and fake game cheats used to spread the malware.
.webp)
SpyCloud found Claude Code credentials containing OAuth access tokens, refresh tokens, and authentication material for connected Model Context Protocol servers.
Other stolen files included account identifiers and standing instructions used by the assistant. Codex authentication data contained an OpenAI API key alongside access and refresh tokens, while Claude Desktop yielded configuration and usage information.
These items serve different purposes. Access tokens authorize requests, refresh tokens can obtain replacement access tokens, and API keys allow software to use paid services.
Changing a password does not necessarily invalidate every credential already issued. The practical response therefore requires revocation, not simply another password change; validity depends on the provider, token type, and account controls.
Aoki takes a more clearly organized approach, placing stolen AI material in a dedicated collection category. SpyCloud observed data associated with ChatGPT, Claude Code, Claude Desktop, Codex, GitHub Copilot, and Cursor.
Previous coverage of Aoki AI credential theft likewise described its growing interest in locally stored AI authentication files and session data. Some recovered files contained cookies for authenticated desktop application sessions.
Reusing a valid cookie can let an attacker resume an existing session without entering the password or completing the MFA check required for a new login. This is endpoint credential theft, not evidence that ChatGPT, Claude, or Codex suffered a service-side breach.
Stolen AI Access Creates Financial and Enterprise Risks
The stolen material already has buyers. SpyCloud observed underground offers advertising AI subscriptions and API credit at steep discounts, including $100 of claimed Codex or Claude API credit for $8.94.
Researchers cautioned that they could not establish whether every advertised credential came from malware rather than phishing, exposed secrets, or fraudulent registrations.
This market supports LLMjacking, where criminals consume AI services using someone else’s account.
Reporting on AI token jacking risks explains how compromised keys can feed illicit proxy services and leave victims facing unexpected charges. SpyCloud also observed wholesale services offering suppliers commissions when uploaded keys generated billable usage.
.webp)
For businesses, configuration theft adds another concern: attackers can learn which services an assistant reaches and how the developer works.
Earlier research into AI coding agent theft highlighted how saved connections, prompt histories, and project context can reveal internal systems. Exposure depends on what files were collected and which associated credentials remain valid.
Incident responders should include AI credentials in every developer-device infostealer investigation. Revoke active sessions, rotate exposed API keys and tokens, and review unusual API consumption.
Check connected services as well: replacing an AI account password does not automatically resolve every secret or authorization copied from the infected endpoint.
Indicators of compromise (IoCs):-
| Type | Source-reported value | Investigation context |
|---|---|---|
| Command-and-control domain | neihite[.]cc | Destination contacted by recovered Aoki samples |
| Temporary working-file prefix | %TEMP%\akg_ | Prefix used by Aoki working files |
| Collection folder | AISessions | Category containing stolen AI application data |
Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
