SpyCloud: commodity stealers now take Claude Code and Codex tokens

01What happened

Trevor Hilligoss of SpyCloud Labs published an analysis of stealer logs on October 30, 2026. He reports that WardenStealer, a Rust infostealer sold as a service on the Russian-language Exploit and XSS forums, added AI-agent collection to its standard build in version 1.9, announced September 29, 2026. SpyCloud first saw the family on August 3, 2026 and has since ingested more than 130,000 unique infections attributed to it.

02How it works

The stealers copy files rather than break anything. In WardenStealer logs SpyCloud found the Claude Code OAuth credentials file, which holds access and refresh tokens together with tokens for connected MCP servers, the Claude Code account configuration file, a CLAUDE.md instruction file, and the Codex CLI authentication file carrying an OpenAI API key. Aoki, a Go-compiled stealer, sorts its output into top-level folders and keeps an AISessions folder with per-tool subfolders, including Netscape-format cookie files for the desktop Claude and ChatGPT builds.

03Who is affected

Developer machines on Windows running Claude Code, OpenAI Codex, Cursor, GitHub Copilot or the Claude and ChatGPT desktop apps are in scope. SpyCloud says the pattern is not limited to one family: Gen Digital has documented AI-agent collection in Remus and Amatera, and tracks WardenStealer as the malware it previously called CallbackBeaver. Symantec published the first vendor analysis of Aoki on October 15, 2026 and tied it to no known group.

04What to do

Treat AI tool credentials as in scope for every infostealer investigation on a developer machine. Rotate exposed API keys and OAuth tokens, then revoke active sessions, because stolen tokens and cookies survive a password reset and an MFA prompt. Watch the affected accounts for unusual API usage.

Sources 3 links, all fetched

1. 1spycloud.comSpyCloud Labs Analysis
2. 2security.comSymantec Aoki Analysis
3. 3research.checkpoint.comCheck Point Teardown