Loading story…
Information-stealing malware operators are expanding collection rules to harvest locally stored artifacts from AI-assisted development tools including Claude, Codex, Cursor, Cline, Continue, OpenCode, Gemini, and Kilo. Targeted files can contain account and refresh tokens, API keys, MCP configuration secrets, connected-service credentials, prompt and conversation histories, project metadata, and account details—creating opportunities for account takeover, paid API abuse, intellectual-property exposure, phishing, and fraud. The activity does not exploit a vulnerability in the AI agents; stealers already installed on endpoints are being remotely reconfigured to collect predictable local data stores.
Gen Digital observed multiple established stealer families pursuing these artifacts, while BlackFog reported that the MaaS malware Bee Stealer v2.1 includes dedicated .codex and .claude collection paths and advertises theft of associated authentication data and chat histories. Bee Stealer also gathers browser and application data, system information, screenshots, and user files, then uses an "AI PC profile" feature to generate English- and Russian-language victim profiles from stolen logs. Its operator panel supports searching, filtering, tagging, bulk log downloads, and processing stolen Google access tokens, enabling criminals to quickly identify and prioritize high-value victims.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Okta analyzed a 7 GB infostealer dump released on Telegram on August 2, 2026, containing data from 5,871 infected machines in 162 countries. The dataset included thousands of unexpired AI-service authentication tokens and still-valid API keys that could be replayed or abused for account takeover and LLMjacking.
During the first half of 2026, Gen Digital telemetry recorded infostealer detections among more than 3.3 million unique protected users, with monthly detections exceeding 500,000 protected users.
Bee Stealer version 2.1 introduced an AI PC profile feature that generates English and Russian victim-profile files from stolen log data, apparently through external service-side processing. Static analysis also verified dedicated .codex and .claude collection paths, though the precise files or fields exfiltrated from those locations were not fully confirmed.
Amatera was observed targeting Cline and Continue data, while Remus targeted Claude, Cursor, and OpenCode; CallbackBeaver added Cursor and Claude artifacts to its collection scope. BeeStealer, STG Stealer, HydraStealer, APEX Stealer, Otter Stealer, and macOS-focused Djinn Stealer were also associated with AI-agent-data collection.
Multiple information-stealing malware families expanded remotely managed collection rules to target locally stored data from AI development agents, including Claude, Cline, Codex, Continue, Cursor, OpenCode, Gemini, and Kilo. The targeted artifacts can include session and refresh tokens, MCP configuration secrets, API keys, prompt histories, conversations, and project metadata; the activity does not rely on a vulnerability in the AI agents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourceblackfog.com
Open sourcegendigital.com
Open sourceauth0.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat intelligence reporting identified the first documented in-the-wild case of **infostealer malware** exfiltrating *OpenClaw* (formerly *ClawdBot/MoltBot*) agent files to steal **API keys, authentication tokens, and other secrets** stored in the agent’s persistent configuration/memory environment. Hudson Rock assessed the activity as likely tied to a **Vidar** infostealer variant and framed it as a shift from traditional browser-credential theft toward harvesting the “identity” and access of local AI agents that can interact with email, communications apps, local files, and online services. Separate weekly roundups and commentary amplified the broader risk theme around **agentic AI** and secret sprawl, including mentions of OpenClaw-related exposure and tooling intended to help organizations discover where such agents are running. Other items in the set (e.g., Ivanti EPMM exploitation, Notepad++ supply-chain compromise, macOS ClickFix “Matryoshka,” and various breach/ransomware claims) describe distinct incidents and are not part of the OpenClaw infostealer event.
Jun 29, 2026
A malware campaign impersonated **Claude Code** and targeted AI developers with trojanized installers that delivered the **ACR Stealer** infostealer, according to Straiker. The operation used fake branding and likely relied on developer trust in popular AI tooling to lure victims into downloading malicious packages, with the apparent goal of stealing credentials, tokens, and other sensitive data from developer environments. Straiker reported that the malware used techniques associated with Go-based tooling and obfuscation, including the use of **`garble`**, an open-source utility for obfuscating Go builds, to hinder analysis and detection. The campaign highlights the growing abuse of trusted AI developer brands in social-engineering attacks and the elevated risk to source code, cloud access, and secrets stored on compromised developer workstations.
Aug 14, 2026
**Stealc**, a malware-as-a-service Windows information stealer advertised on Russian-speaking cybercrime forums in January 2023, rapidly gained criminal adoption. The malware borrows capabilities and design elements from Vidar, Raccoon, Mars, and RedLine, stealing browser credentials and cookies, cryptocurrency-wallet data, desktop-wallet files, and information from Discord, Telegram, Outlook, Steam, and Tox. Researchers observed more than 40 samples and at least 35 active command-and-control servers, with campaigns using YouTube videos and cracked-software downloads as lures. Stealc uses RC4 and Base64 string obfuscation, dynamic API resolution, sandbox checks, staged C2 tasking, and self-deletion following exfiltration. It is part of a broader active ecosystem of Windows stealers including RedLine, MetaStealer, and Agent Tesla: RedLine dominated observed telemetry during 2022–2023, while Agent Tesla activity increased through 2024. Defenders should prioritize detection of suspicious access to browser credential stores and cryptocurrency-wallet files, as well as unsigned executables communicating with Telegram or Discord infrastructure.
Sep 9, 2026