credential-stealer-activitycredential-access-methodcybercrime-service-ecosystemai-platform-security

WardenStealer and Aoki Steal AI Tokens That Can Survive Password Resets

Malware Intelligence · 3 sources · Updated 12h ago · First seen Oct 30, 2026

Windows infostealers WardenStealer and Aoki are harvesting AI-tool authentication tokens, API keys, session cookies, and configuration files alongside traditional passwords and browser data. SpyCloud identified the theft in recovered infection logs involving Claude Code, Codex, Claude Desktop, ChatGPT, GitHub Copilot, and Cursor, and reported more than 130,000 unique WardenStealer infections since August 3, 2026. Stolen credentials can allow attackers to reuse authenticated sessions without a fresh multifactor authentication challenge; some may remain valid after password resets. The findings concern compromised endpoints, not evidence of service-side breaches at AI providers.

Underground sellers are monetizing AI access through discounted subscriptions, API-credit resale, and unauthorized AI consumption known as LLMjacking, potentially generating unexpected charges and exposing connected development and cloud services. SpyCloud could not establish that every advertised credential originated from malware. Organizations investigating endpoint infections should explicitly revoke AI sessions and tokens, rotate exposed API keys, review connected services, and monitor anomalous API consumption rather than relying on password resets alone.

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

10 events · May 2026 – Oct 30, 2026

Reported Oct 30, 20266d ago
Gen Digital documents AI-agent collection in Remus and Amatera
Gen Digital also documented AI-agent collection capabilities in Remus and Amatera, showing that this functionality extended beyond WardenStealer and Aoki.
Infostealers Now Target AI Tokens and API Keys | SpyCloud
Reported Oct 30, 20266d ago
SpyCloud identifies underground markets monetizing AI credentials
SpyCloud observed Telegram markets selling AI subscriptions, API keys, credits, and authenticated sessions, including offers advertising $100 of Codex or Claude API credit for $8.94 and wholesale services paying suppliers based on usage. Automated feeds paired OpenAI keys with host information suggestive of infostealer sourcing, but researchers could not establish that every advertised credential came from malware.
Infostealers Now Target AI Tokens and API Keys | SpyCloud
Reported Oct 30, 20266d ago
WardenStealer adds AI-agent collection through custom rules
WardenStealer initially collected AI-agent data through operator-requested custom rules, before the capability became part of its standard build.
Infostealers Now Target AI Tokens and API Keys | SpyCloud
Oct 30, 20266d ago
SpyCloud documents AI credential theft in recovered infostealer logs
SpyCloud's research report confirmed that WardenStealer and Aoki collected AI-tool credentials, tokens, configuration files, and session material, with targets including Claude Code, Codex, ChatGPT, GitHub Copilot, and Cursor. The report documented more than 130,000 unique WardenStealer infections since its first observation and identified Aoki's AISessions collection folder and neihite[.]cc command-and-control domain.
Infostealers Now Target AI Tokens and API Keys | SpyCloud
Oct 15, 202621d ago
Symantec publishes analysis of Aoki's expanding AI-file collection
Symantec reported that earlier Aoki builds lacked AI-file collection and that the newer capability was still expanding. It found no links to existing malware families or known threat groups and inferred a financial motive from the target list.
Infostealers Now Target AI Tokens and API Keys | SpyCloud
Oct 13, 202623d ago
Recovered Aoki infection counts grow through October 13
Infection times derived from SpyCloud's recovered Aoki data showed growth through October 13, followed by a slight decline.
Infostealers Now Target AI Tokens and API Keys | SpyCloud
Oct 4, 20261mo ago
SpyCloud first observes Aoki in recovered infection data
SpyCloud first observed Aoki in recovered data, establishing the family's presence in its infection-log collection.
Infostealers Now Target AI Tokens and API Keys | SpyCloud
Sep 29, 20261mo ago
WardenStealer version 1.9 announced with standard AI-data collection
WardenStealer version 1.9 was announced with AI-agent data collection incorporated into the standard build, rather than requiring operator-requested custom rules.
Infostealers Now Target AI Tokens and API Keys | SpyCloud
Aug 3, 20263mo ago
SpyCloud first observes WardenStealer
SpyCloud first observed WardenStealer in its recovered data. Gen Digital separately reported increasing prevalence of the Rust-based Windows infostealer in early August 2026.
Infostealers Now Target AI Tokens and API Keys | SpyCloud
May 2026
Earliest known WardenStealer builds appear
Gen Digital dated the earliest WardenStealer builds to early May 2026 and identified the family as the malware it had previously called CallbackBeaver.
Infostealers Now Target AI Tokens and API Keys | SpyCloud

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

2 linked

Aoki WardenStealer

Affected products

7 linked

Claude CodeChatgptCursorClaudeCodex CliCodexClaude Desktop

Organizations

4 linked

AnysphereAnthropicOpenaiGitHub

Observables

1 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Nov 4, 2026

Hackers Use New Infostealer Malware to Steal ChatGPT, Claude, and Codex Tokens That Survive Password ResetsOpen source ↗

Cryptika BlogNews · Nov 4, 2026

Hackers Use New Infostealer Malware to Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets | Cryptika CybersecurityOpen source ↗

Spycloud BlogNews · Oct 30, 2026

Infostealers Now Target AI Tokens and API Keys | SpyCloudOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News