30
30
55
42
42
30
30
55
42
55
30
30
60
30
30
Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data
Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.
Gen Digital researchers found commodity infostealers extending their collection rules to local AI coding agent data from Claude, Cursor, Codex, Cline, Continue and OpenCode on Windows and macOS. Amatera targets Cline and Continue, Remus targets Claude, Cursor and OpenCode, and CallbackBeaver added Claude and Cursor with more than 5,000 samples observed in 30 days; Djinn Stealer hits Claude, Codex, Gemini, Cline, OpenCode and Kilo on macOS. Stolen data includes access and refresh tokens, prompt histories, conversation databases and MCP configurations holding API keys, potentially exposing connected source-control, cloud and ticketing systems. Remus is assessed as a Lumma Stealer variant using EtherHiding C2 resolution via Ethereum smart contracts.
62
30
N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
Datadog researchers detonated a new N4D Mesh Controller sample in microVMs, revealing rotated infrastructure, a UPX-packed go-titan agent, and persistence behavior.
Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated command infrastructure and a UPX-packed agent labeled go-titan. Runtime evidence showed MCP tool abuse, multi-service scanning, and persistence mechanisms. The report provides hunting guidance for defenders tracking this infrastructure.
55
30
30
42
30
42
30
42
42
Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR
60
42
30
30
30
30
60
55
30
30
60
60
42
30