WardenStealer and Aoki (Aokigahara) Infostealers Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets

Key facts for WardenStealer and Aoki infostealers

Detection coverage for WardenStealer and Aoki infostealers

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5220 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Aoki (Aokigahara) akg_ Temp Files and AISessions Staging Folders — Post-Exploitation

Detects Aoki/Aokigahara stealer staging of stolen data: files created with the %TEMP%\akg_ working prefix and files written under a top-level AISessions folder with per-tool subfolders (ChatGPT, Claude, Codex, GitHub Copilot, Cursor). Tags the AI tool being harvested so analysts know which tokens to rotate.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1074.001, T1005, T1552.001
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (TargetFilename="*\\Temp\\akg_*" OR TargetFilename="*\\AISessions\\*") | eval path_lc=lower(TargetFilename) | eval ai_tool=case(like(path_lc,"%aisessions%chatgpt%"),"ChatGPT", like(path_lc,"%aisessions%claude%"),"Claude", like(path_lc,"%aisessions%codex%"),"Codex", like(path_lc,"%aisessions%copilot%"),"GitHub Copilot", like(path_lc,"%aisessions%cursor%"),"Cursor", like(path_lc,"%aisessions%"),"AISessions-other", true(),"akg_temp_file") | stats count dc(TargetFilename) as file_count values(ai_tool) as ai_tools values(TargetFilename) as sample_files min(_time) as first_seen max(_time) as last_seen by host User Image | convert ctime(first_seen) ctime(last_seen) | table host User Image ai_tools file_count sample_files first_seen last_seen

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has "AISessions" or (FolderPath has @"\Temp\" and FileName startswith "akg_")
| extend AITool = case(FolderPath has "ChatGPT", "ChatGPT", FolderPath has "Claude", "Claude", FolderPath has "Codex", "Codex", FolderPath has "Copilot", "GitHub Copilot", FolderPath has "Cursor", "Cursor", FolderPath has "AISessions", "AISessions-other", "akg_temp_file")
| summarize FileCount = dcount(FolderPath), AITools = make_set(AITool), SampleFiles = make_set(FileName, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath

Sigma

title: Aoki Stealer akg_ Temp Files or AISessions Staging Folder
id: 1d9e6b37-82a4-4f0c-b5d3-6a7e2c9f0b02
status: experimental
description: Detects file creation matching the Aoki (Aokigahara) infostealer temp-file prefix akg_ in the user temp directory or an AISessions staging folder holding stolen AI-tool data.
references:
    - https://www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/
    - https://blog.gridinsoft.com/aokigahara-ai-sessions-developer-keys/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.collection
    - attack.t1074.001
    - attack.t1005
    - attack.credential_access
    - attack.t1552.001
logsource:
    category: file_event
    product: windows
detection:
    selection_akg:
        TargetFilename|contains: '\Temp\akg_'
    selection_ai:
        TargetFilename|contains: '\AISessions\'
    condition: 1 of selection_*
falsepositives:
    - Legitimate software that happens to use an akg_ temp prefix or an AISessions folder name
level: high

Known false positives:

• Unrelated software using an akg_ temp prefix (e.g. AKG audio tooling)
• Internal tools or backups that create a folder named AISessions

Tuning notes: Exclude known audio/AKG vendor software by Image path. Treat any hit with an ai_tool value as confirmed token exposure: rotate API keys, revoke OAuth sessions at ChatGPT/Claude/Codex/Copilot/Cursor. Temp-folder names may vary between Aoki builds, so also review ZIP staging (SIG-003).

• 🔒 Remote Thread or Memory Injection into explorer.exe from User-Writable Path — WardenStealer Loader · unlock with TL Creds
• 🔒 Mass Access to AI-Tool, Browser and Developer Credential Stores by Non-Allowlisted Process — Token Theft · unlock with TL Creds
• 🔒 Connections to Aoki C2 [indicator] and Community-Observed ClickFix/Malvertising Infrastructure — C2 · unlock with TL Creds
• 🔒 ClickFix Command Recorded in Explorer RunMRU Registry Key — Execution · unlock with TL Creds
• 🔒 Unsigned DLL Sideloaded by Executable in User-Writable Directory — WardenStealer Loader · unlock with TL Creds
• 🔒 ZIP Archive Staged in Temp by Process Running from User-Writable Path — Aoki Exfiltration Staging · unlock with TL Creds
• 🔒 WardenStealer ClickFix Paste-and-Run Shell Spawned by explorer.exe — Execution · unlock with TL Creds
• 🔒 Aoki Stealer C2 Domain [indicator] DNS/Network Contact — Command and Control · unlock with TL Creds

Indicators of compromise for WardenStealer and Aoki infostealers

As of 2026-11-04, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5220.

Sample indicators (1 of 15)

• Domain: neihite[.]cc

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

How WardenStealer and Aoki infostealers works

SpyCloud has ingested more than 130,000 unique WardenStealer infections since 2026-08-03, and stolen AI tokens can remain valid after a password reset.

WardenStealer is a Windows information stealer written in Rust and sold as a service on Russian-language forums (Exploit, XSS). Gen Digital (Gen Threat Labs) links it to the earlier CallbackBeaver malware through its Rust implementation, code-morphing functionality and specific cryptocurrency clipper configurations. The earliest builds appeared in May 2026, the forum listing in August 2026, and SpyCloud first saw it in its collection on 2026-08-03. Gen reports an in-house loader that runs in three modes (injection, DLL sideloading, standalone). The injection mode decodes a hidden payload with a per-build custom Base64-style alphabet and injects the rebuilt stealer into explorer.exe on a new thread. Loader files use heavy padding to evade AV scanning, and the stealer uses string encoding, dynamic API lookups, indirect jumps and junk-code insertion. It bypasses Chromium Application-Bound Encryption by locating encrypted master keys in browser memory and hijacking browser threads to decrypt them in place. It also includes a clipper covering ten cryptocurrency networks. C2 traffic is HTTPS with a custom binary format, with 1-5 hardcoded C2 domains per build and fallbacks, and the initial registration carries a system fingerprint (hardware ID, OS version, username, installed software). Gen reports pricing of $450/month (personal) and $1,500/month (enterprise), and the operators claim about 110 customers (unverified). Version 1.9 formalised AI token theft. Logs carry a 'Stealed by Warden' banner.

Aoki (also tracked as Aokigahara) is a Go-compiled Windows stealer. SpyCloud first saw it on 2026-10-04, with peak activity on 2026-10-13. Symantec's Threat Hunter Team reported on 2026-10-15 that it appears to be in active development. Check Point Research analysed it on 2026-10-23. Aoki stages stolen data in named top-level folders. An AISessions category holds per-tool subfolders for ChatGPT, Claude Code, the Microsoft Store build of Claude Desktop, Codex, GitHub Copilot and Cursor. Reports also name Gemini CLI, Windsurf, JetBrains AI Assistant, Kiro, Amazon Q and AWS sign-on data. Other categories include Browser, Games, Messengers and FTP. Symantec saw it target .claude.json, Claude desktop cookies, ChatGPT cookies and the Codex config.toml and .env files. Check Point and GridinSoft add auth.json, state databases, Git/SSH credentials and private keys, and AWS/Azure/GCP configuration, plus screenshots and clipboard contents. Exfiltration is ZIP archives encrypted with AES-GCM, uploaded with labelled headers per collection category. Execution flags depend on configuration, and there are optional language and environment checks. Temporary working files use the %TEMP%\akg_ prefix ('akg' refers to Aokigahara). The only published network indicator is the C2 domain neihite.cc. Neither SpyCloud nor Symantec attributes Aoki to a known group or malware family, and its cryptocurrency focus suggests a financial motive.

WardenStealer delivery relies on ClickFix paste-and-run lures, malicious search advertising, cracked software, fake game cheats and trojanized installers. SpyCloud found Claude Code OAuth credential files (access and refresh tokens) and Codex authentication material (an OpenAI API key plus access and refresh tokens) in WardenStealer logs. It also found Netscape-format session cookies, CLAUDE.md instruction files, MCP server credentials, account/machine identifiers and plan-usage history.

Impact: a token lifted from a developer's install carries that developer's access, and much of that access survives both a password reset and MFA prompts, because a password change does not invalidate credentials already issued. SpyCloud reports underground resale (for example a $100 Codex/Claude credit for $8.94, and 40-60% discounts on subscriptions). It also reports wholesale reseller commissions of 35% (Anthropic/AWS Bedrock Claude keys) and 20% (OpenAI keys), and feeds that post live OpenAI project keys with machine identifiers, hostnames, usernames and IPs. This feeds LLMjacking abuse. Defenders should treat AI-tool credentials as in scope for infostealer incidents: rotate exposed keys and tokens, revoke active sessions at every connected service, and watch for anomalous API usage.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1074.001 Local Data Staging; T1113 Screen Capture; T1115 Clipboard Data; T1560.001 Archive via Utility

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1497.001 System Checks; T1574.001 DLL; T1574.002 DLL Side-Loading

Command and Control

T1071.001 Web Protocols

Discovery

T1082 System Information Discovery

Execution

T1204.002 Malicious File; T1204.004 Malicious Copy and Paste

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers

Lateral Movement

T1550.004 Web Session Cookie

Resource Development

T1583.008 Malvertising

Remediation for WardenStealer and Aoki infostealers

Immediate actions

• Treat AI-tool credentials (ChatGPT, Claude Code/Desktop, Codex, GitHub Copilot, Cursor, MCP server secrets) as in scope for any infostealer incident on a developer endpoint
• Rotate exposed API keys and OAuth tokens and revoke active sessions at each provider, not just the account password
• Block neihite.cc at DNS and proxy and hunt for %TEMP%\akg_* files and AISessions folders
• Monitor AI provider usage for anomalous API calls, new source IPs and unexpected spend

Workarounds

• Restrict execution of unsigned software and block clipboard-to-Run-dialog ClickFix patterns where policy allows
• Restrict which processes may read AI tool config and credential files on developer machines

Longer-term hardening

• Keep AI tool credentials short-lived and scoped, and avoid long-lived API keys on developer workstations
• Deploy EDR with behavioral detection for process injection into explorer.exe, DLL sideloading and mass reads of browser/credential stores
• Train users against ClickFix paste-and-run lures, malvertising and cracked software or game cheats
• Apply existing credential-rotation discipline to the new AI token category

Affected and fixed versions

• Microsoft — Windows (infostealer target platform)
  Vulnerable versions: Windows endpoints running targeted AI applications
• OpenAI — ChatGPT desktop app and Codex (tokens/API keys/config exposed)
  Vulnerable versions: Locally installed credential files
• Anthropic — Claude Code and Claude Desktop incl. Microsoft Store build (OAuth tokens/cookies exposed)
  Vulnerable versions: Locally installed credential files
• GitHub / Microsoft — GitHub Copilot (credentials exposed)
  Vulnerable versions: Locally installed credential files
• Anysphere — Cursor (credentials exposed)
  Vulnerable versions: Locally installed credential files

Timeline of WardenStealer and Aoki infostealers

Last updated 2026-11-04 · revalidated 1× · latest source

• 2026-05-01 Earliest locked-ioc-5 builds observed (early May 2026, month precision), per Gen Threat Labs and SpyCloud
• 2026-08-01 locked-ioc-5 advertised as a service on Russian-language forums (Exploit, XSS) in August 2026 (month precision)
• 2026-08-03 SpyCloud first ingests locked-ioc-5 infections into its collection; more than 130,000 unique infections follow by the end of October
• 2026-09-03 Anthropic states that infostealer-captured Claude session keys were used to mint unauthorized Claude Code OAuth tokens and burn paid usage; it force-signs-out affected users and refunds charges.
• 2026-09-29 locked-ioc-5 v1.9 is announced with AI-tool collection built into the standard build; September 2026 is the peak month of observed infections.
• 2026-10-04 SpyCloud first observes locked-ioc-14 (Go-based stealer) in recovered infection logs
• 2026-10-12 Gen Threat Labs publishes its Warden Stealer analysis (loader, ABE bypass, clipper, AI token theft, locked-ioc-4 link)
• 2026-10-13 locked-ioc-14 activity peaks in SpyCloud's data
• 2026-10-15 Symantec Threat Hunter Team reports new locked-ioc-14 variants targeting locked-ioc-6, Claude desktop cookies, ChatGPT cookies and Codex locked-ioc-8/locked-ioc-15
• 2026-10-23 Check Point Research analyses locked-ioc-10: locked-ioc-11 module, AES-GCM encrypted ZIP uploads, ide credential handler
• 2026-10-30 SpyCloud publishes 'Infostealers Now Target AI Tokens and API Keys' covering both families and AI-credential resale markets
• 2026-11-04 Cyber Security News reports that stolen ChatGPT, Claude and Codex tokens survive password resets

Update history

• 2026-11-04 — locked-ioc-5 and locked-ioc-14 Infostealers Harvest AI Session Tokens, OAuth Tokens and API Keys from ChatGPT, Claude and Developer Tooling: What changed No field escalation: severity HIGH, exploitability ACTIVE, status ACTIVE, attribution LOW all unchanged. Adds provider-confirmed real-world abuse (Anthropic, 2026-09-03) and the v1.9 date for AI-token collection. New indicators

Sources cited for WardenStealer and Aoki infostealers

• SpyCloud: Infostealers Now Target AI Tokens and API Keys spycloud.com · Research · 2026-10-30
• GridinSoft: Aokigahara Stealer Targets AI Sessions and Developer Keys (Check Point Research analysis) blog.gridinsoft.com · Blog · 2026-10-23
• Hackers Use New Infostealer Malware to Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets cybersecuritynews.com · News · 2026-11-04
• Infosecurity Magazine: New Aoki Infostealer Targets AI Coding Assistant Credentials (Symantec Threat Hunter Team) infosecurity-magazine.com · News · 2026-10-15
• SecurityOnline: Warden Stealer Rust Infostealer (Gen Threat Labs analysis) securityonline.info · News · 2026-10-12
• Dark Reading: 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants Dark Reading · News
• Daily Security Review: Warden Stealer Rust Infostealer Targets AI Coding-Agent Tokens dailysecurityreview.com · News
• Cyber Security News: New Aoki Malware cybersecuritynews.com · News

More in malware

• Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic Reconstruction
• China-Aligned SlippyNunchucks Hijacks Sogou Input Method DNS Requests to Deploy DarkVigil (FDMTP) Backdoor (CVE-2026-120422)
• XLoader (FormBook) Infostealer Delivered via Fake Business Order Phishing, RAR/JScript/LuaJIT Chain with In-Memory Injection
• AI-Generated Malware: Source-Code Indicators and Trends (HUMAN Security / VoidLink / PROMPTSTEAL)
• Fake-download campaign uses trojanized Inno Setup installers to deliver monetization payloads (WorldProxyPool, CharityEngine/BOINC, AW Manager)