# SpyCloud: commodity stealers now take Claude Code and Codex tokens

> WardenStealer and Aoki collect the OAuth tokens and configuration files that Claude Code, Codex, Cursor and Copilot keep on disk.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Incident, Research
- **Published by:** SpyCloud
- **Disclosed:** 2026-10-30
- **Affects:** Claude Code, OpenAI Codex, Cursor, GitHub Copilot, Claude Desktop, ChatGPT Desktop
- **Research by:** Trevor Hilligoss (SpyCloud Labs)
- **Primary source:** https://spycloud.com/blog/infostealers-now-target-ai-tokens-and-api-keys/
- **Page:** https://theinjection.dev/items/spycloud-intelstealers-ai-tokens/

Commodity infostealers have added modules that collect OAuth tokens, API keys and session files from local AI coding tools, SpyCloud reports. It has ingested more than 130,000 unique WardenStealer infections since August 3, 2026.

## What happened

Trevor Hilligoss of SpyCloud Labs published an analysis of stealer logs on October 30, 2026. He reports that WardenStealer, a Rust infostealer sold as a service on the Russian-language Exploit and XSS forums, added AI-agent collection to its standard build in version 1.9, announced September 29, 2026. SpyCloud first saw the family on August 3, 2026 and has since ingested more than 130,000 unique infections attributed to it.

## How it works

The stealers copy files rather than break anything. In WardenStealer logs SpyCloud found the Claude Code OAuth credentials file, which holds access and refresh tokens together with tokens for connected MCP servers, the Claude Code account configuration file, a CLAUDE.md instruction file, and the Codex CLI authentication file carrying an OpenAI API key. Aoki, a Go-compiled stealer, sorts its output into top-level folders and keeps an AISessions folder with per-tool subfolders, including Netscape-format cookie files for the desktop Claude and ChatGPT builds.

## Who is affected

Developer machines on Windows running Claude Code, OpenAI Codex, Cursor, GitHub Copilot or the Claude and ChatGPT desktop apps are in scope. SpyCloud says the pattern is not limited to one family: Gen Digital has documented AI-agent collection in Remus and Amatera, and tracks WardenStealer as the malware it previously called CallbackBeaver. Symantec published the first vendor analysis of Aoki on October 15, 2026 and tied it to no known group.

## What to do

Treat AI tool credentials as in scope for every infostealer investigation on a developer machine. Rotate exposed API keys and OAuth tokens, then revoke active sessions, because stolen tokens and cookies survive a password reset and an MFA prompt. Watch the affected accounts for unusual API usage.

## Quick facts

- **Families:** WardenStealer, written in Rust, and Aoki, compiled in Go: both Windows
- **First seen:** WardenStealer August 3, 2026; Aoki October 4, 2026, in SpyCloud data
- **Infections:** More than 130,000 unique WardenStealer infections ingested
- **AI module added:** WardenStealer version 1.9, announced September 29, 2026
- **Artifacts taken:** OAuth and refresh tokens, API keys, session cookies, MCP server tokens, CLAUDE.md
- **Resale price:** A one-month Codex API key with $100 of credit sold for $8.94
- **Status:** Active: SpyCloud cannot confirm every listing came from stealer logs

## Sources

1. [SpyCloud Labs Analysis](https://spycloud.com/blog/infostealers-now-target-ai-tokens-and-api-keys/)
2. [Symantec Aoki Analysis](https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting)
3. [Check Point Teardown](https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/)