Threat reportMalwareTL-2026-4557
Infostealers Target AI Service Credentials, Session Tokens and API Keys (Aokigahara, Warden Stealer, StealC)
Infostealers Target AI Service Credentials, Session Tokens (TL-2026-4557), also tracked as Aoki, is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects OpenAI ChatGPT Desktop, Codex, OpenAI API keys, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1055), and is covered by 9 detection rules and 23 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-4557
- Threat ID
- TL-2026-4557
- Also known as
- Aoki, Aokigahara, Warden Stealer, CallbackBeaver
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cloud services, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Infostealers Target AI Service Credentials, Session Tokens
Malware and tooling: Aokigahara, Stealc, Warden Stealer, ClickFix
How Infostealers Target AI Service Credentials, Session Tokens works
Intrinsec reports that infostealer operators are increasingly harvesting AI service credentials: about 33% of logs sold on Russian Market contain LLM authentication data, up from 26% year-over-year. Aokigahara (aisessions module), Warden Stealer (Rust MaaS, v1.9) and StealC are the families named; session-token theft bypasses MFA.
Intrinsec (published 2026-10-27) analysed 260,000 stealer logs sold on Russian Market over 12 months and found 87,000 (about 33%, up from 26% a year earlier) containing LLM authentication data. By share of AI-related data captured, OpenAI accounts for 88.65%, HuggingFace 10.69% and Mistral 0.28%; Anthropic appears in only about 12 Russian Market logs, but Okta reportedly recovered a 7 GB dump covering 5,871 machines in 162 countries that contained 561 valid Anthropic session tokens, 164 of them still active. Stolen data includes authentication and configuration files, session tokens, API keys and conversation histories for OpenAI, HuggingFace, Mistral, Anthropic, Gemini, GitHub Copilot, Cursor, Windsurf, AWS, Azure and Google Cloud. The Okta dump figures come only from the Intrinsec article and could not be independently confirmed.
Aokigahara (also tracked as Aoki) was first reported by Symantec and the Carbon Black Threat Hunter Team on 2026-10-15 and analysed in depth by Check Point Research on 2026-10-23. It is a Windows stealer with a config-driven module_mask that dispatches sysinfo, browsers, aisessions, ide, wallets and a separate clipper component. The aisessions module collects local credential and state files for Claude (.claude\credentials.json, .claude.json, the Claude MSIX package), ChatGPT Desktop, Codex (auth.json, config.toml, .env), Cursor and Windsurf (state.vscdb), GitHub Copilot (.copilot\config.json, hosts.json) and Gemini CLI tokens. A separate collection looks for AWS/Azure/GCP configuration (.aws\credentials, .aws\sso\cache), Git credentials and SSH keys. Exfiltration uses an X25519 key exchange followed by AES-256-GCM encrypted ZIP chunks posted to /gate/handshake, /gate/chunk and /gate/complete with a Microsoft-CryptoAPI/10.0 user-agent and X-* headers; older builds used plaintext HTTP on port 8080. The malware refuses to run on CIS-region locales and applies debugger, VM and sandbox checks. Symantec could not tie it to a known group and assessed the actor as financially motivated (resale of keys or LLMjacking).
Warden Stealer is a Rust-based malware-as-a-service product (formerly tracked as CallbackBeaver, per Gen Threat Labs). Early builds were seen in May 2026 and advertising began in August 2026; v1.9 (late September) made AI coding-agent token collection an official feature, covering access and refresh tokens, MCP configuration identifiers and prompt histories for tools such as Claude, Codex, Grok and Cursor. Its integrated loader decodes the payload with a per-build custom Base64-style alphabet, injects it into the process owning the taskbar (usually explorer.exe), and supports injection, DLL sideloading and standalone modes. It bypasses Chromium Application-Bound Encryption by hijacking a browser thread to decrypt the master key, ships a clipper covering ten cryptocurrency networks, and uses HTTPS with a proprietary binary protocol and 1-5 hardcoded C2 domains per build. Pricing is reported at $450/month (Personal) and $1,500/month (Enterprise). StealC is cited by Intrinsec as the second fastest-growing stealer for AI data since August 2026.
Initial infection vectors named in the sources are fake installers, software cracks, game cheats, malicious ads and ClickFix. Because session tokens represent authenticated sessions, their theft bypasses MFA. Intrinsec stresses that this is theft from compromised endpoints, not a breach of the AI providers themselves. No CVEs are involved. Intrinsec recommends revoking sessions and rotating API keys on suspected compromise, shortening token lifetimes with refresh-token rotation and device-bound sessions, keeping plaintext secrets out of MCP agent/server configurations, and treating AI accounts as enterprise identity assets with anomaly monitoring.
MITRE ATT&CK techniques used in TL-2026-4557
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1497 Virtualization/Sandbox Evasion; T1574.001 DLL; T1622 Debugger Evasion
Command and Control
Discovery
T1082 System Information Discovery; T1614.001 System Language Discovery
Execution
T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers
Impact
Affected products and versions in Infostealers Target AI Service Credentials, Session Tokens
- OpenAI — ChatGPT Desktop, Codex, OpenAI API keys
Vulnerable versions: Credentials and sessions on compromised endpoints - Anthropic — Claude Desktop, Claude Code, Anthropic session tokens
Vulnerable versions: Credentials and sessions on compromised endpoints - Various — HuggingFace, Mistral, Google Gemini CLI, GitHub Copilot, Cursor, Windsurf, JetBrains AI Assistant, Kiro, Amazon Q, AWS, Azure, Google Cloud
Vulnerable versions: Locally stored authentication/config files on Windows endpoints infected by stealers
Remediation for Infostealers Target AI Service Credentials, Session Tokens
Immediate actions
- Revoke active sessions and rotate API keys/OAuth tokens for AI services (OpenAI, Anthropic, HuggingFace, Mistral, Gemini, Copilot, Cursor, Windsurf) and cloud providers on any host suspected of infostealer infection
- Rotate AWS/Azure/GCP credentials, SSH keys and Git tokens present on affected developer endpoints
- Block the Aokigahara C2 domains and IP listed in the IOCs and hunt for the Microsoft-CryptoAPI/10.0 user-agent with /gate/handshake, /gate/chunk and /gate/complete URIs
Workarounds
- Restrict developers from running pirated software or pasting commands from web pages into Run/PowerShell
- Use enterprise-managed AI accounts with SSO and conditional access instead of personal accounts on corporate endpoints
Longer-term hardening
- Shorten session/token lifetimes, rotate refresh tokens and enforce device-bound sessions
- Treat AI accounts as enterprise identity assets with anomaly monitoring on API usage and logins
- Keep plaintext secrets out of MCP agent/server configuration files and use a secrets manager
- Deploy EDR with behavioural detection for explorer.exe injection and access to AI tool credential stores by non-owning processes
- Train users to recognise ClickFix prompts and avoid cracked software and unofficial installers
Weaknesses (CWE) in Infostealers Target AI Service Credentials, Session Tokens
Timeline of Infostealers Target AI Service Credentials, Session Tokens
- Gen Threat Labs first spots early builds of Warden Stealer (then tracked as CallbackBeaver); exact day not stated, May 2026.
- Warden Stealer MaaS is advertised on underground forums and prevalence rises sharply; Intrinsec notes Warden and StealC as the fastest-growing stealers for AI data from August 2026. Exact day not stated.
- Warden Stealer v1.9 announced in late September 2026, making AI coding-agent token collection an official feature (exact day approximate).
- Symantec and the Carbon Black Threat Hunter Team report new Aoki infostealer builds targeting Claude, Codex, Cursor, Gemini, Copilot, JetBrains AI, Kiro and AWS credentials.
- Check Point Research publishes a detailed analysis of Aokigahara, documenting the aisessions module, C2 protocol, IOCs and over 150 samples.
- Gridinsoft publishes technical coverage of Aokigahara AI session and developer key theft.
- Intrinsec publishes its analysis: 87,000 of 260,000 Russian Market logs (about 33%, up from 26%) contain LLM authentication data; an Okta-recovered 7 GB dump covers 5,871 machines in 162 countries.
Sources cited for Infostealers Target AI Service Credentials, Session Tokens
- Les infostealers prennent l'IA en ligne de mire (Intrinsec)
- Infostealer Riding the AI Train (Check Point Research)
- New Aoki Infostealer Targets AI Coding Assistant Credentials (Infosecurity Magazine, reporting Symantec)
- Aoki Infostealer: AI Coding Credentials (SecurityOnline)
- Aokigahara Stealer Targets AI Sessions and Developer Keys (Gridinsoft)
- Warden Stealer Rust Infostealer (SecurityOnline, citing Gen Threat Labs)
- Warden Stealer Rust Infostealer Targets AI Coding-Agent Tokens (Daily Security Review)
- WARDEN Stealer: Claims, Cookie Theft Risk, and Removal (Gridinsoft)
Detection coverage for TL-2026-4557
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4557 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.