Malware · 1 source · latest 1h

WardenStealer and Aoki infostealers target ChatGPT, Claude and Codex tokens that survive password resets

MALWAREChatGPTredteam/daily · 1 source

Severity: High
Sources: 1

What happened

The Windows infostealers WardenStealer and Aoki are harvesting OAuth tokens, cookies and API keys from AI tools including ChatGPT, Claude Code, Codex, GitHub Copilot and Cursor, according to SpyCloud. Access and refresh tokens may remain valid after a password reset, allowing attackers to act as authenticated users without a fresh MFA challenge. SpyCloud reported more than 130,000 unique WardenStealer infections since the family was first seen on 3 August 2026, and stolen AI access is being sold cheaply for LLMjacking.

For IT people · Written by AI from 1 source · Wrong?

What to do

Revoke active AI sessions and tokens on any affected device, not just change the password.
Rotate exposed API keys and tokens, including Codex and Claude credentials.
Review unusual API consumption on AI accounts for signs of misuse.
Check services connected to AI assistants, such as repositories, cloud services and build pipelines, for exposed secrets.

Written by AI from the sources, checked against them

Read the full story at the source