TL;DR
- Infostealers now target AI coding tools: WardenStealer and Aoki steal session cookies, OAuth tokens, API keys, and configuration files from Claude Code, Codex, Cursor, GitHub Copilot, and the Claude and ChatGPT desktop apps. SpyCloud has recaptured more than 130,000 WardenStealer infections since August 2026.
- These tokens outlast a password reset: A stolen AI token or session cookie keeps much of its access after a password reset and MFA prompt, and these tools often connect to source control, cloud accounts, and build pipelines.
- Criminals already put a price on AI access: Underground shops sell AI subscriptions and API credit at 40% to 91% below list price, and wholesale services pay suppliers up to 35% of billings for uploaded keys. That demand fuels LLMjacking, where attackers bill inference to someone else’s account.
- The damage adds up fast: Sysdig researchers estimated in 2024 that a single abused account can run past $46,000 a day in charges, and found reverse proxies that had relayed more than two billion tokens. Stolen keys may also support unauthorized distillation, where adversaries train smaller models on frontier model outputs.
- What defenders should do now: Treat AI tool credentials as in scope for any infostealer investigation on a developer’s machine: rotate exposed keys and tokens, revoke active sessions, and watch for anomalous API use.
For most of the past decade, an infostealer log has held the same three things in roughly the same order:
- a system-information file,
- a dump of saved browser credentials, and
- the cookies to go with them.
Modern stealers have also introduced fancy new modules to steal crypto, extract additional data from browser caches, and find monetizable data in local system files and applications. However, none of these additions have fundamentally changed the main value proposition of an infostealer malware log. The value to the buyer has been stable too: a log is a packaged identity, priced by freshness, and how easily monetizable it is, and the market that moves them has not needed to change what it sells.
Over the last several months, a small number of malware families have added a new element. Alongside the passwords and the cookies exfiltrated now sits a set of desirable configuration and token files belonging to local AI coding tools: Claude Code, OpenAI’s Codex, Cursor, GitHub Copilot, as well as the desktop builds of Claude and ChatGPT. The security press has started calling the families that do this “AI stealers,” which credits them with more novelty than the results show; these are still the same type of commodity Malware-as-a-Service infostealers that have been popular for nearly a decade, just pointed at a new directory.
In reality, these so-called AI stealers are simply adding a new module to go after a new valuable type of data stored in a standard way across many endpoint devices. Nonetheless, this small addition has had big impacts within the cybercrime ecosystem
A saved password is a credential the victim can rotate, and a stolen browser cookie expires on a schedule the service controls. An AI-agent token is different in a way that matters to a defender. The files these families collect hold OAuth access and refresh tokens, standing API keys, and the local configuration of tools that are wired into source control, cloud accounts, and build pipelines. A token lifted from a developer’s Claude Code or Codex install can carry the developer’s access with it, and much of that access survives both the password reset and the multi-factor prompt that would stop a reused credential.
SpyCloud has ingested recaptured logs at scale from two malware families that collect this data from local AI coding tool configurations: WardenStealer and Aoki. Having the logs rather than the builder advertisement lets us describe what is actually taken from the victim, instead of only speculating based on code analysis.
Note: WardenStealer and Aoki are not the only two families with this capability. Gen Digital has documented AI-agent collection across several of the most prevalent stealers, including Warden Stealer itself, Remus, and Amatera. Symantec also named Aoki in a report on October 15, 2026. The technique is spreading through the commodity market.
SpyCloud Labs has chosen these two families to dig into in this research specifically because they are relatively new entrants to the market and document a more focused capability than other stealers we’ve analyzed, where the “AI” function either relies on parsing existing data (like autofills) or has been bolted on following the initial surge of market interest in this material.
WardenStealer
Our team first observed WardenStealer in our collection on August 3, 2026, and we have since ingested more than 130,000 unique infections that we attribute to the family.
Number of unique WardenStealer infections recaptured by SpyCloud over time. Note that some sources take longer to distribute new stealer logs, so there is usually a slight downturn in new infection data available for the most recent dates.
WardenStealer is a Windows information stealer written in Rust, sold as a service and promoted openly on the Russian-language forums Exploit and XSS; the banner written into every log reads “Stealed by Warden” and lists a support handle and forum threads.
Gen Digital, which has published the most detailed public analysis of the family, tracks it as the same malware it previously called CallbackBeaver, and places the first builds in early May 2026, with prevalence rising in early August of the same year.
WardenStealer collects the usual categories of data – system data, saved credentials, cookies, autofill – as well as a very broad application set beyond them: remote-access tools including AnyDesk and TeamViewer, gaming clients including Steam and Epic, FTP clients such as FileZilla, saved RDP connections, and the messengers Telegram and Discord.
It ships with its own loader and a cryptocurrency clipper, and it carries an Application-Bound Encryption bypass to recover Chromium cookies that Gen notes resembles the technique used by Vidar and Remus.
Warden places its application data in a single general Applications folder, one subfolder per supported program. The AI tools sit among the others as additional subfolders rather than as a distinct category: in the logs SpyCloud Labs analyzed, Claude Code, Claude Desktop, and Codex CLI appeared alongside Discord, Steam, and AnyDesk. Gen reports that AI-agent collection reached Warden in stages: operators requested it first through custom rules, and the standard build folded it in at version 1.9, announced on September 29, 2026.
The contents are the sensitive part. Inside Claude Code, SpyCloud Labs observed the OAuth credentials file that Claude Code writes to disk, holding the access and refresh tokens for the account along with tokens for connected Model Context Protocol (MCP) servers; the account configuration file carrying the user and machine identifiers; and the CLAUDE.md instruction file that Claude Code loads as standing guidance. “Codex CLI” yielded the Codex authentication file, which stores an OpenAI API key together with access and refresh tokens. Claude Desktop contained its configuration and a plan-usage history.
Aoki stealer
Aoki first appeared in SpyCloud’s recaptured data on October 4, 2026. Ingestion was sparse at first, with derived infection times indicating a rise through October 13 followed by a slight decline.
Number of unique Aoki stealer infections recaptured by SpyCloud over time. Note that some sources take longer to distribute new stealer logs, so there is usually a slight downturn in new infection data available for the most recent dates.
Typical structure of an Aoki stealer log.
That folder held per-tool subfolders for ChatGPT, Claude Code, the Microsoft Store build of Claude Desktop, Codex, GitHub Copilot, and Cursor, each containing the tokens, configuration, and session material specific to that tool: the Claude Code credentials and account configuration, the Codex authentication file and its config, Copilot and Cursor token files, and cookie files for the web-backed tools.
The cookie files are the most immediately dangerous item in that folder. Several of the AISessions subfolders held cookies in the Netscape cookie-file format, corresponding to the embedded web sessions that the desktop AI applications maintain – the Microsoft Store Claude Desktop build and the ChatGPT desktop app both authenticate through a Chromium-based view that stores cookies the way a browser does.
A live session cookie lets an attacker resume an authenticated session directly, without the password and without triggering the multi-factor check that a fresh login would require (if configured). The same logic applies to the OAuth and API tokens in the other subfolders; the account protections that stop a stolen password count for nothing against stolen session and token material.
The Aoki samples we recovered are Go-compiled Windows binaries that write working files to a %TEMP%\akg_ prefix (akg corresponds to the Aokigahara name) and beacons to a command-and-control domain, neihite[.]cc, that appears on Symantec’s published indicator list. Consistent with a commodity stealer rather than a targeted tool, the samples carry no operator command set; they collect what is present and send it onward.
Delivery, where we have it, runs through the familiar commodity malware distribution channels: ClickFix-style paste-and-run lures, malicious search advertising, fake game cheats, and trojanized installers. Symantec notes that it did not establish how Aoki reaches a machine, and the delivery artifacts in our own data come from victim browser history rather than from the malware, so neither source points to a single primary vector.
A market that prices AI access
A stealer collects what somebody will buy, and the market downstream now puts a price on AI access. Our Telegram chatter collection shows a market that already treats AI accounts, API keys, and sessions as priced commodities, organized into the same harvesting, wholesale, and retail tiers that formed years ago around bank and streaming credentials.
Example message from a Telegram bot that surfaces stolen AI API keys to criminals.
At the retail end, underground storefronts sell AI subscriptions and API credit beside the usual streaming inventory, with automatic delivery and “warranties” against an account that stops working. One catalog advertised a one-month Codex API key carrying 100 US dollars of credit for 8.94 dollars, a 100-dollar Claude API token for the same, and Cursor and Gemini access on comparable terms. A Russian-language shop offered Claude, ChatGPT, and Grok subscriptions at an advertised 40 to 60 percent below list prices for the corresponding services. Another Telegram bot promoted OpenAI and Anthropic access at up to 91 percent below official pricing, with deposits starting at a single US dollar.
Pricing that far beneath face value is consistent with credit the seller never paid for, and strongly suggests that the keys being offered were stolen, whether through the use of infostealer malware or by some other means.
Beneath the shops there is also a wholesale layer. One service advertised a commission panel that pays suppliers for the use of keys they upload – a stated 35 percent of billings on Anthropic and AWS Bedrock Claude keys, 20 percent on OpenAI keys – with daily payouts. That arrangement is the engine behind LLMjacking, the practice of billing inference to someone else’s paid account; it gives a harvested key a standing resale value independent of anything else in a log.
Example advertisement by an AI API key reseller recruiting new sources of stolen and fraudulently obtained API keys.
The harvesting layer is visible as well. We have observed automated feeds that post live OpenAI project keys formatted with a machine identifier, hostname, local username, and IP address, which are datapoints that wouldn’t accompany a key scraped from a code repository or some other internet-facing location (meaning they are likely from infostealer logs). Separately, inbox checkers search compromised email inboxes for AI provider mail. One marked a mailbox as valid and surfaced recent Claude Console sign-in links and an “Action needed: your Claude API access is turned off” notice, the messages an operator would use to reach the account and the keys behind it.
Example message from a bot that surfaces relevant emails (in this case, sign in emails from Anthropic) from compromised email inboxes to criminals.
SpyCloud researchers cannot confirm that all of the material being sold was taken by infostealer malware rather than by secret-scanning, phishing, or fraudulent signup. However, we can say with certainty that AI accounts, API keys, and sessions each now carry a price of their own, and that standing demand is the market reason a commodity stealer would begin collecting them. The apparent focus of the newest commodity infostealers on stealing AI keys appears to correlate with this market demand.
Where the market goes from here
Reselling access
These keys sell because inference isn’t cheap, especially when spent on frontier models. Sysdig’s threat researchers documented the mechanics in May 2024, and estimated that a single abused account could run past $46,000 a day in charges. They found reverse proxies – relays that present one working key to many users – whose logged traffic had already crossed two billion tokens.
Microsoft’s 2024 case against the group it tracks as Storm-2139 described that chain in full – stolen Azure OpenAI keys, a tool built to strip the guardrails, resale as a service – and named four alleged operators in February 2025. In the Chinese context, unauthorized AI API proxy services are commonly called “transfer stations,” and researchers have documented that some of these services offer access to AI models at as low as 10% of the list price.
Distillation
Distillation involves leveraging a high capacity “teacher” model to train a smaller, more efficient model. The teacher model generates responses, step-by-step reasoning traces, or probability outputs, which are then used as training data for the smaller model, resulting in a model that often performs better than a similarly sized model trained off the teacher model’s original training data. This process isn’t inherently malicious (frontier AI labs often do this on their own), but the leading US AI labs have stated that some transfer stations collect data to facilitate unauthorized distillation. Sysdig also flagged training-data extraction as a possible LLMjacking motive in its first report, and Team Cymru later counted more than 10,800 self-hosted gateways pooling credentials to frontier models in a manner that they assessed supports distillation alongside token resale.
Bulk queries against a frontier API can yield training data worth more to a competitor than the bill they leave behind. OpenAI and Microsoft alleged in January 2025 that a group linked to DeepSeek (a major Chinese AI lab) had pulled data through the API against OpenAI’s terms, routing requests through obfuscated resellers. OpenAI did not sue and has not published its evidence, so it is impossible to say whether or to what extent this alleged distillation made use of the market for stolen keys, but we do know that the transfer network model is highly dependent on stolen and fraudulently obtained keys.
The outlook
Whether the market for stolen keys grows or thins out depends on forces already in motion. Working against it, providers detect and revoke exposed keys faster than they did a year ago, and abnormal consumption is easier to flag than it was. On the other hand, demand for uncensored and unattributable AI generation does not fall when prices fall. Session and OAuth material resists rotation in a way a saved password never did, and the agentic tokens now reaching stealer logs carry access a plain inference key does not.
For a defender the practical consequence is that an infostealer infection on a developer’s machine is no longer only a credential-rotation problem. A log from either family can carry live session cookies, OAuth tokens, and API keys for AI tools that are themselves connected to code and cloud. A stolen CLAUDE.md or an MCP configuration can also describe the environment those tokens reach into.
Treating AI-tool credentials as ‘in scope’ for an endpoint-compromise investigation – rotating the exposed keys and tokens, and watching for anomalous API use – is the same discipline already applied to any other credential pulled from a stealer log, extended to a category that did not exist in these logs a year ago. Defenders are going to have to expand their processes to include this whole new category of identity compromise.
Your organization's data may already be exposed.
Billions of assets from this year’s identity events are circulating right now.
FAQs
SpyCloud has ingested recaptured logs at scale from two families that collect this data: WardenStealer and Aoki. They are not the only ones. Gen Digital has documented AI-agent collection in Remus and Amatera as well, and the technique is spreading through the commodity market.
The files hold OAuth access and refresh tokens, standing API keys, and local configuration for tools wired into source control, cloud accounts, and build pipelines. In the logs we analyzed, that included the Claude Code credentials file, the Codex authentication file, Copilot and Cursor token files, instruction files like CLAUDE.md, and session cookies from desktop AI apps.
A saved password can be rotated, and a stolen browser cookie expires on a schedule the service controls. OAuth tokens, API keys, and live session cookies behave differently. A token lifted from a developer’s install can carry that developer’s access with it, and much of that access survives both a password reset and the multi-factor prompt that would stop a reused credential.
Because there is a market for them. Underground shops sell AI subscriptions and API credit at steep discounts, wholesale services pay suppliers a share of billings for uploaded keys, and automated feeds surface live keys from infected machines. Stolen keys also feed LLMjacking, where inference is billed to someone else’s account, and may support unauthorized distillation of frontier models
Treat AI-tool credentials as in scope for the investigation. That means rotating the exposed keys and tokens, revoking active sessions, and watching for anomalous API use. It is the same discipline already applied to any other credential pulled from a stealer log, extended to a category that did not exist in these logs a year ago.
Keep reading
