# Infostealers Target AI Service Credentials, Session Tokens and API Keys (Aokigahara, Warden Stealer, StealC)

> Intrinsec reports that infostealer operators are increasingly harvesting AI service credentials: about 33% of logs sold on Russian Market contain LLM authentication data, up from 26% year-over-year. Aokigahara (aisessions module), Warden Stealer (Rust MaaS, v1.9) and StealC are the families named; session-token theft bypasses MFA.

- **Published:** 2026-10-27T18:12:45Z
- **Last reviewed:** 2026-10-27T18:12:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4557
- **ID:** TL-2026-4557
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Intrinsec (published 2026-10-27) analysed 260,000 stealer logs sold on Russian Market over 12 months and found 87,000 (about 33%, up from 26% a year earlier) containing LLM authentication data. By share of AI-related data captured, OpenAI accounts for 88.65%, HuggingFace 10.69% and Mistral 0.28%; Anthropic appears in only about 12 Russian Market logs, but Okta reportedly recovered a 7 GB dump covering 5,871 machines in 162 countries that contained 561 valid Anthropic session tokens, 164 of them still active. Stolen data includes authentication and configuration files, session tokens, API keys and conversation histories for OpenAI, HuggingFace, Mistral, Anthropic, Gemini, GitHub Copilot, Cursor, Windsurf, AWS, Azure and Google Cloud. The Okta dump figures come only from the Intrinsec article and could not be independently confirmed.

Aokigahara (also tracked as Aoki) was first reported by Symantec and the Carbon Black Threat Hunter Team on 2026-10-15 and analysed in depth by Check Point Research on 2026-10-23. It is a Windows stealer with a config-driven module_mask that dispatches sysinfo, browsers, aisessions, ide, wallets and a separate clipper component. The aisessions module collects local credential and state files for Claude (.claude\credentials.json, .claude.json, the Claude MSIX package), ChatGPT Desktop, Codex (auth.json, config.toml, .env), Cursor and Windsurf (state.vscdb), GitHub Copilot (.copilot\config.json, hosts.json) and Gemini CLI tokens. A separate collection looks for AWS/Azure/GCP configuration (.aws\credentials, .aws\sso\cache), Git credentials and SSH keys. Exfiltration uses an X25519 key exchange followed by AES-256-GCM encrypted ZIP chunks posted to /gate/handshake, /gate/chunk and /gate/complete with a Microsoft-CryptoAPI/10.0 user-agent and X-* headers; older builds used plaintext HTTP on port 8080. The malware refuses to run on CIS-region locales and applies debugger, VM and sandbox checks. Symantec could not tie it to a known group and assessed the actor as financially motivated (resale of keys or LLMjacking).

Warden Stealer is a Rust-based malware-as-a-service product (formerly tracked as CallbackBeaver, per Gen Threat Labs). Early builds were seen in May 2026 and advertising began in August 2026; v1.9 (late September) made AI coding-agent token collection an official feature, covering access and refresh tokens, MCP configuration identifiers and prompt histories for tools such as Claude, Codex, Grok and Cursor. Its integrated loader decodes the payload with a per-build custom Base64-style alphabet, injects it into the process owning the taskbar (usually explorer.exe), and supports injection, DLL sideloading and standalone modes. It bypasses Chromium Application-Bound Encryption by hijacking a browser thread to decrypt the master key, ships a clipper covering ten cryptocurrency networks, and uses HTTPS with a proprietary binary protocol and 1-5 hardcoded C2 domains per build. Pricing is reported at $450/month (Personal) and $1,500/month (Enterprise). StealC is cited by Intrinsec as the second fastest-growing stealer for AI data since August 2026.

Initial infection vectors named in the sources are fake installers, software cracks, game cheats, malicious ads and ClickFix. Because session tokens represent authenticated sessions, their theft bypasses MFA. Intrinsec stresses that this is theft from compromised endpoints, not a breach of the AI providers themselves. No CVEs are involved. Intrinsec recommends revoking sessions and rotating API keys on suspected compromise, shortening token lifetimes with refresh-token rotation and device-bound sessions, keeping plaintext secrets out of MCP agent/server configurations, and treating AI accounts as enterprise identity assets with anomaly monitoring.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1055 Process Injection
- T1574.001 DLL
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1082 System Information Discovery
- T1614.001 System Language Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1657 Financial Theft

## Sources

- [Les infostealers prennent l'IA en ligne de mire (Intrinsec)](https://www.intrinsec.com/les-infostealers-prennent-lia-en-ligne-de-mire/)
- [Infostealer Riding the AI Train (Check Point Research)](https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/)
- [New Aoki Infostealer Targets AI Coding Assistant Credentials (Infosecurity Magazine, reporting Symantec)](https://www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/)
- [Aoki Infostealer: AI Coding Credentials (SecurityOnline)](https://securityonline.info/aoki-infostealer-ai-coding-credentials/)
- [Aokigahara Stealer Targets AI Sessions and Developer Keys (Gridinsoft)](https://blog.gridinsoft.com/aokigahara-ai-sessions-developer-keys/)
- [Warden Stealer Rust Infostealer (SecurityOnline, citing Gen Threat Labs)](https://securityonline.info/warden-stealer-rust-infostealer/)
- [Warden Stealer Rust Infostealer Targets AI Coding-Agent Tokens (Daily Security Review)](https://dailysecurityreview.com/?p=44403)
- [WARDEN Stealer: Claims, Cookie Theft Risk, and Removal (Gridinsoft)](https://blog.gridinsoft.com/warden-stealer-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4557