WardenStealer and Aoki Target AI Coding Tools on Windows: Stolen Tokens and Incident Response

The research comes from SpyCloud Labs. According to its report, WardenStealer and Aoki steal session cookies, OAuth tokens, API keys, and configuration files from Claude Code, Codex, Cursor, GitHub Copilot, and the Claude and ChatGPT desktop apps. GitHub Copilot is a Microsoft product, these are Windows binaries, and the targets are the tools developers use every day. That puts this squarely in the lap of Windows admins and security teams.

What SpyCloud found​

SpyCloud's report, written by Trevor Hilligoss and published October 30, 2026, is based on stolen logs that SpyCloud recovered from criminal sources, not just on taking samples apart. That matters. Malware code shows what a stealer can grab. Recovered logs show what it actually took from real machines.

The headline number: SpyCloud says it has ingested more than 130,000 unique WardenStealer infections since first observing the family in its collection on August 3, 2026. Read that carefully. It counts infections SpyCloud attributes to WardenStealer. It does not count compromised AI accounts, and not every one of those infected machines necessarily had AI tools installed. SpyCloud also warns that the newest data is usually incomplete because some sources are slow to pass logs along.

SpyCloud argues that nothing here involves a flaw in an AI model. Its point is that the "AI stealer" label gives these families too much credit. They are the same kind of rent-a-stealer malware that has been around for nearly a decade, just aimed at a new folder. Gen Digital, which owns Norton and Avast, reached the same conclusion on its own in September. Its research says the malware is already running on the device, and that what has changed is how much valuable material now sits in predictable locations, sometimes in plaintext.

Section summary: Old-school infostealers, new loot. The 130,000 figure measures WardenStealer infections, not confirmed AI-account takeovers.

WardenStealer: Rust, rented out, and very broad​

SpyCloud describes WardenStealer as a Windows infostealer written in Rust, sold as a subscription service and advertised openly on the Russian-language criminal forums Exploit and XSS. Gen Digital tracks it as the malware it previously called CallbackBeaver. Gen dates the first builds to early May 2026 and says activity climbed in early August.

Its target list is wide:

• System information, saved browser credentials, cookies and autofill data
• Remote-access tools such as AnyDesk and TeamViewer
• Gaming clients including Steam and Epic, the FileZilla FTP client, and saved RDP connections
• The Telegram and Discord messaging apps
• A cryptocurrency clipper, its own loader, and a bypass for Chrome's App-Bound Encryption that Gen says resembles techniques used by the Vidar and Remus stealers

The AI collection arrived in stages. Gen says operators first asked for it through custom collection rules, and the standard build added it in version 1.9, announced September 29, 2026. SecurityOnline's earlier coverage of Gen's work quotes Gen calling Warden "one of the first infostealers we have observed stealing configuration files and local data belonging to AI assistants and agentic coding tools."

In the logs SpyCloud examined, the AI tools simply sat next to Discord, Steam and AnyDesk in the stealer's general Applications folder. What they contained was the alarming part:

The Claude Code credentials file also held tokens for connected Model Context Protocol (MCP) servers, through which AI tools connect to other services. So one stolen file can contain access to the AI account and to services that account is wired into. Having a token for a connected server doesn't prove an attacker used it, or that it unlocks everything behind it. But incident responders now have to check it.

Section summary: WardenStealer treats AI tools as just more apps to loot. One stolen Claude Code file can carry account tokens, MCP server tokens, and a map of how the developer works.

Aoki: smaller, newer and more targeted​

Aoki first appeared in SpyCloud's recaptured data on October 4, 2026. SpyCloud says the samples it recovered are Windows binaries written in Go. Where Warden lumps AI apps in with everything else, Aoki gives them their own top-level folder, AISessions, alongside Browser, Games, Messengers and FTP.

According to SpyCloud, that folder had a subfolder for each of these tools:

• ChatGPT
• Claude Code
• The Microsoft Store build of Claude Desktop
• Codex
• GitHub Copilot
• Cursor

SpyCloud considers the cookie files the most immediately dangerous item. Several AISessions subfolders held cookies in the Netscape cookie-file format. SpyCloud says those came from the Microsoft Store build of Claude Desktop and the ChatGPT desktop app, both of which log in through an embedded Chromium-based view that stores cookies the way a browser does. In other words, your "desktop app" is partly a browser in disguise, and it leaves cookies on disk like one.

Symantec published the first vendor analysis of Aoki on October 15, according to SpyCloud. Symantec found that earlier builds didn't touch AI files, that the AI collection is recent and still growing, and that it couldn't tie Aoki to any existing malware family or known group.

Indicators Windows defenders can hunt for​

SpyCloud listed two indicators that are directly useful on Windows:

• Working files written to %TEMP% with an akg_ prefix
• Network traffic to the command-and-control domain neihite[.]cc, which SpyCloud says also appears on Symantec's indicator list

These are research indicators, not a complete detection signature. If one turns up in your EDR telemetry or proxy logs, you have a lead. If neither turns up, that doesn't prove the machine is clean.

A naming note: Check Point Research separately documented a stealer it calls Aokigahara. SpyCloud says the akg prefix corresponds to the Aokigahara name, so the two are clearly related. Still, the reports differ in scope, so it's wise to keep them apart. Check Point says Aokigahara also targets Windsurf, Gemini CLI and JetBrains AI Assistant, plus Git credentials, SSH-related files, and AWS, Azure and Google Cloud credential files. Check Point is also careful about limits. It says it has not confirmed that operators reused or sold stolen AI credentials, and it does not claim attackers combine the AI and cloud modules into one attack path.

Section summary: Aoki is newer and more focused, and the Chromium cookies held by the ChatGPT and Microsoft Store Claude desktop apps are its sharpest weapon.

Why MFA doesn't save you here​

The core problem is session hijacking. A valid session cookie lets an attacker pick up a session that is already logged in. They never type the password, so they never hit the MFA check that a fresh login would trigger. Refresh tokens are a related risk: Refresh tokens may extend access by obtaining replacement access tokens.

SpyCloud's own wording is blunt. It says much of the access in these files survives both a password reset and an MFA prompt. Gen Digital is more careful. It says what happens next depends on each token's scope, lifetime and the provider's controls, so a stolen file doesn't guarantee lasting access. Both positions can be true. Not every token outlives a reset, but you can't assume yours won't.

Gen also points out that stolen context can hurt as much as stolen access. Prompt histories and transcripts can contain proprietary source code, internal hostnames, and secrets someone pasted into a chat while troubleshooting. That's reconnaissance an attacker gets for free.

The market: discounted AI and LLMjacking​

Criminals steal what they can sell. SpyCloud observed underground offers advertising AI subscriptions and API credit at steep discounts, including $100 of claimed Codex or Claude API credit for $8.94. Other listings advertised Claude, ChatGPT and Grok subscriptions at 40% to 60% off, and a Telegram bot promised OpenAI and Anthropic access at up to 91% below official prices. One wholesale service offered suppliers 35% of billings on Anthropic and AWS Bedrock Claude keys and 20% on OpenAI keys.

This feeds LLMjacking: running AI workloads on someone else's account so the victim gets the bill. SpyCloud cites Sysdig's 2024 estimate that one abused account could exceed $46,000 a day in charges. That is a modeled worst case, not a bill any WardenStealer or Aoki victim has been confirmed to receive. SpyCloud also admits it can't prove all of these listings came from infostealers. Some keys may have come from leaked secrets found in code, phishing, or fraudulent sign-ups.

Microsoft has fought this kind of abuse in court before. SpyCloud points to Microsoft's legal action against the group it tracks as Storm-2139. That case involved stolen Azure OpenAI keys, a tool built to strip out safety guardrails, and resale of the access as a service, and Microsoft named four alleged operators in February 2025. Anyone running Azure OpenAI or Foundry workloads should take note that API keys are a commodity in this market.

How these stealers get in​

SpyCloud says the delivery methods it has seen are the familiar ones:

• ClickFix-style lures that trick users into pasting and running a command
• Malicious search ads
• Fake game cheats
• Trojanized installers

Neither SpyCloud nor Symantec identified one main delivery method for Aoki. For Windows shops, the takeaway is old but still true. Users who paste commands from a fake CAPTCHA into the Run dialog or a terminal remain one of the most reliable ways in.

What to do after an infection on a developer PC​

SpyCloud's core advice: treat AI-tool credentials as part of every infostealer investigation on a developer's machine. Rotate exposed keys and tokens, revoke active sessions, and watch for unusual API use. Gen Digital adds some useful detail. Here's a sensible order, built from both reports:

1. Contain the endpoint first. Isolate and reimage or fully clean the machine. Rotating credentials while the stealer is still running just hands it fresh ones.
2. Work from a clean device. Gen specifically recommends revoking AI-service sessions from a clean machine.
3. Revoke sessions and tokens, not just passwords. Sign out all sessions for ChatGPT, Claude, Copilot and Cursor accounts through each provider's own controls. A password change alone may leave live tokens behind.
4. Rotate API keys. That includes OpenAI keys that may have sat in Codex's auth file and any Anthropic or cloud-hosted model keys.
5. Audit MCP connections. Rotate any credentials used by MCP servers. Remove servers you no longer use and cut the rest down to the permissions they actually need.
6. Check usage and billing. Unexpected spikes in model consumption are often the first visible sign of LLMjacking.
7. Assess what the chat history exposed. If secrets were ever pasted into prompts, rotate them as well.

Gen also offers prevention advice. Where a tool gives you the choice, store credentials in the operating system's credential store rather than in files. Prefer short-lived, narrowly scoped tokens. Keep personal, development and production access separate. Gen also warns that encryption at rest doesn't help if the decryption key sits right next to the data.

The bigger picture​

Is this a revolution in malware? No, and SpyCloud is right to push back on the "AI stealer" hype. It's the same stealer business, with one more folder added to the collection list. But that's exactly what makes it dangerous. Gen notes that many stealers get their collection rules remotely, so adding the next popular AI tool can be one configuration update pushed to machines that are already infected.

AI assistants have become the working memory of the developer workstation. They hold credentials, project context, and connections into source control and the cloud. Attackers have noticed. Defenders who still treat a stealer infection as a "reset the browser passwords" ticket are working from an outdated checklist.

Bottom line: If a developer's Windows PC gets hit by an infostealer, assume their AI tools were looted along with everything else. Revoke the sessions, rotate the keys, audit the MCP connections and check the bill, ideally before someone else spends the next $46,000 of your AI budget.