Malware · 1 source · latest 2h

Infostealers Are Stealing ChatGPT and Claude Tokens That Survive Password Resets

MALWARESpyCloudredteam/daily · 1 source

Severity: High
Sources: 1

What happened

SpyCloud reports recapturing more than 130,000 unique WardenStealer infections since August 2026, with the malware expanding into AI developer environments to harvest ChatGPT and Claude authentication files. These tokens can preserve unauthorised access after a password reset, so a reset alone does not evict an attacker. The article attributes this to endpoint compromise and commodity credential theft rather than a vulnerability in the AI models; no CVE is cited.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Revoke active ChatGPT and Claude sessions and tokens, not just the account password.
Check developer endpoints for infostealer infection before reissuing AI credentials.

Written by AI from the sources, checked against them

Read the full story at the source