SpyCloud reports WardenStealer and Aoki infostealers stealing AI tool tokens
SpyCloud reports WardenStealer and Aoki malware stealing AI tool tokens from Windows devices, so revoke AI sessions and keys, not just passwords.
- Published
- Exploitation
- No vulnerability exploitation is reported, SpyCloud says it found stolen AI credentials in recovered infostealer logs
What happened
According to Cyber Security News, researchers at SpyCloud report that two Windows infostealer families, WardenStealer and Aoki, collect authentication tokens, session data and configuration files from locally installed AI tools. The outlet reports that SpyCloud based its findings on recovered infection logs, not only on malware advertisements or code analysis. This advisory relies on one outlet’s summary of SpyCloud’s research. The SpyCloud report itself was not among the sources, and none of the AI providers named has commented in the sources.
- WardenStealer: Cyber Security News says SpyCloud’s October 30 report counts more than 130,000 unique WardenStealer infections since SpyCloud first observed the family on August 3, 2026. The outlet describes it as a Rust-based Windows infostealer sold as malware-as-a-service. It collects:
- browser passwords and cookies
- messaging data
- cryptocurrency information
- files belonging to AI applications
Earlier reporting cited by the outlet links its distribution to ClickFix lures, malicious ads, cracked software and fake game cheats.
- Stolen AI material from WardenStealer: Per the article, SpyCloud found:
- Claude Code credentials with OAuth access tokens, refresh tokens and authentication material for connected Model Context Protocol servers, plus account identifiers and standing instructions
- Codex authentication data with an OpenAI API key and access and refresh tokens
- Claude Desktop configuration and usage information
- Aoki: The outlet reports that Aoki stores stolen AI material in a dedicated category. SpyCloud observed data tied to ChatGPT, Claude Code, Claude Desktop, Codex, GitHub Copilot and Cursor. Some files contained cookies for authenticated desktop sessions.
- Why a password reset may not help: Cyber Security News notes that a valid cookie can let an attacker resume an existing session without the password or a new MFA check. It also says changing a password does not necessarily invalidate tokens already issued, and that validity depends on the provider, token type and account controls.
- Not a provider breach: The outlet states this is endpoint credential theft, not evidence of a service-side breach at ChatGPT, Claude or Codex.
- Resale: SpyCloud observed underground offers of discounted AI subscriptions and API credit, including $100 of claimed Codex or Claude API credit for $8.94, according to the article. The researchers said they could not establish that every advertised credential came from malware rather than phishing, exposed secrets or fraudulent registrations.
Not confirmed: how Aoki is distributed, the number of Aoki infections, and whether any specific organisation was affected.
Am I affected?
Based on Cyber Security News, you may be exposed if both of these are true:
- A Windows device you use was infected with WardenStealer or Aoki.
- That device had ChatGPT, Claude Code, Claude Desktop, Codex, GitHub Copilot or Cursor signed in or configured.
The outlet notes that what is exposed depends on which files were collected and which credentials are still valid. AI assistants connected to repositories, cloud services, build pipelines or MCP servers may also expose those connections.
The article lists these source-reported indicators for Aoki:
| Type | Value | Context |
|---|---|---|
| Command-and-control domain | neihite[.]cc | Contacted by recovered Aoki samples |
| Temporary file prefix | %TEMP%\akg_ | Aoki working files |
| Collection folder | AISessions | Category for stolen AI application data |
What to do now
The steps below are the ones reported by Cyber Security News:
- Include AI tool credentials in every infostealer investigation on a developer device.
- Revoke active sessions for the affected AI accounts. Do not rely on a password change alone.
- Rotate exposed API keys and tokens.
- Review AI API usage for unusual consumption.
- Check services connected to the AI tools. Replacing an AI account password does not automatically resolve every secret or authorisation copied from the infected endpoint.