Infostealer riding the AI Train
- Published by
- Check Point Research
- Published
- 23 Oct 2026
- Indicators
- 4 verified
The report
Key Points Introduction Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and development tools. Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments. This expanded targeting reflects […]
Read the full analysis: Infostealer riding the AI Train (Check Point Research).
Indicators
Malware C
- dfwioeiofwr[.]info
- gate[.]dfwioeiofwr[.]info
- hjazfioe[.]surf
- somelitersofblood[.]pw
Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.
How this is tracked
EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#26). This page is generated from that record and the report’s own title and summary; nothing is rewritten.