Infostealers target ChatGPT Claude API tokens
Original title: Hackers Use New Infostealer Malware to Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets
WardenStealer and Aoki collect AI authentication tokens that survive password resets.
Hackers distribute WardenStealer and Aoki infostealers that steal ChatGPT, Claude, Codex, and other AI tokens and session data. Over 130000 WardenStealer infections were observed since August 2026. Stolen credentials enable LLM jacking and unauthorized API usage.
Unconfirmed: Some stolen keys may originate from phishing or other sources.
- 130000+ WardenStealer infections
- Targets AI sessions and OAuth tokens
- Undetected by password changes
Impact: Theft of AI authentication tokens and sessions
- 1.Revoke AI API keys and tokens
- 2.Review connected AI services
- 3.Rotate authentication tokens
- Malware
- WardenStealerAoki
- Organizations
- SpyCloud
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | neihite.cc | rted value Investigation context Command-and-control domain neihite[.]cc Destination contacted by recovered Aoki samples Temporary |
From the original article
3 min read at cybersecuritynews.com
Hackers are expanding information theft beyond saved passwords, targeting authentication tokens and session data stored by ChatGPT, Claude, Codex, and other AI tools. Two Windows malware families, WardenStealer and Aoki, collect credentials that may remain usable after a password reset, leaving victims exposed even after they believe their accounts are secured. The danger extends beyond […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.