New Infostealers Target AI Tokens, Bypassing Password Resets

Cybercriminals are escalating their information-stealing operations by targeting authentication tokens and session data used by prominent AI services, including ChatGPT, Claude, and Codex. Malware families such as WardenStealer and Aoki, operating on Windows systems, are specifically designed to harvest these credentials. A critical aspect of this threat is that the stolen tokens and session data can remain valid even after a user resets their account password, leaving victims vulnerable to continued unauthorized access.

The implications of this type of credential theft extend far beyond simple access to AI chatbots. Developers frequently integrate these AI assistants with sensitive resources like source code repositories, cloud infrastructure, and build pipelines. When attackers gain access to valid session tokens or API keys, they can operate as authenticated users within these connected environments, potentially exposing proprietary code, cloud configurations, and other critical development assets without needing to re-authenticate or bypass multi-factor authentication.

Security researchers at SpyCloud brought this emerging threat to light by analyzing recovered infection logs. Their findings indicate a significant increase in WardenStealer activity, with over 130,000 unique infections observed since early August 2026. WardenStealer, a Rust-based infostealer distributed via a malware-as-a-service model, not only targets traditional credentials like browser passwords and cookies but also specifically seeks out files associated with locally installed AI applications.

SpyCloud's analysis revealed that WardenStealer has successfully exfiltrated authentication material for AI services, including OAuth access tokens, refresh tokens, and API keys for platforms like Claude Code and Codex. These stolen components allow attackers to authorize requests, obtain new access tokens, and utilize paid AI services without the legitimate user's knowledge or consent. The report highlights that changing a password alone is insufficient to revoke these compromised tokens; a specific revocation process by the service provider is necessary.

The Aoki malware family presents a similarly organized threat, dedicating a specific collection category to stolen AI credentials. It targets a range of AI tools, including ChatGPT, Claude Code, Claude Desktop, Codex, GitHub Copilot, and Cursor. Recovered data from Aoki infections has included session cookies that enable attackers to hijack active user sessions, effectively bypassing the need for passwords and multi-factor authentication entirely.

This campaign represents a form of endpoint credential theft, rather than a breach of the AI service providers themselves. The stolen AI access credentials are already being traded on underground forums, with listings offering discounted AI subscriptions and API credits. While the exact origin of all advertised credentials is not always clear, the existence of this market fuels "LLMjacking," where threat actors consume AI services using compromised accounts, leading to unexpected charges for victims and potential abuse of AI resources.

For organizations, the theft of AI configuration data poses an additional risk. Attackers can gain insights into the services an AI assistant connects to and the developer's workflow. Incident responders are advised to include AI credentials in their investigations of infostealer infections, emphasizing the need to revoke active sessions, rotate exposed API keys and tokens, and scrutinize API usage for any anomalies. Simply changing the password for an AI account is not enough to mitigate the risks associated with compromised endpoint secrets.