Infostealer Malware Harvests ChatGPT and Claude Tokens
Original title: Hackers Are Stealing ChatGPT and Claude Tokens That Changing Your Password May Not Stop
WardenStealer and Aoki steal AI developer credentials like session tokens and API keys, allowing unauthorized access post password reset.
SpyCloud recaptured over 130,000 WardenStealer infections since August 2026, harvesting authentication files from AI applications including Claude Code, ChatGPT, GitHub Copilot and Cursor. Infostealers collect API keys, OAuth tokens and configuration files from predictable directories. Changing passwords alone does not revoke refresh tokens or sessions. Anthropic and others have terminated affected accounts.
- WardenStealer packages AI session tokens with browser credentials
- Attackers create AI Sessions directories for ChatGPT, Claude, Codex
- Underground market prices AI API keys at discounts of 40-91%
- Stolen tokens can be used for LLMjacking and repository access
Impact: unauthorized access to AI accounts and data via stolen tokens
- 1.revoke stolen API keys and OAuth tokens
- 2.review connected services and grants
- 3.monitor for unusual AI usage and billing spikes
- Vendors
- SpyCloudGen Digital
- Malware
- WardenStealerAoki
- Victims
- AI developers
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | neihite.cc | ary paths beginning with %TEMP%\akg_ and communicating with neihite[.]cc. Number of unique Aoki stealer infections recaptured by S |
From the original article
3 min read at gbhackers.com
Infostealer malware is expanding into AI developer environments, harvesting authentication files that can preserve unauthorized access after a password reset. SpyCloud reports recapturing more than 130,000 unique WardenStealer infections since August 2026.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.