# WardenStealer and Aoki (Aokigahara) Infostealers Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets

> Two Windows infostealer families, the Rust-based malware-as-a-service WardenStealer and the Go-based Aoki (Aokigahara), harvest OAuth access/refresh tokens, API keys, session cookies and MCP credentials from AI applications (ChatGPT, Claude Code/Desktop, Codex, GitHub Copilot, Cursor) alongside browser, wallet and messenger data. SpyCloud has ingested more than 130,000 unique WardenStealer infections since 2026-08-03, and stolen AI tokens can remain valid after a password reset.

- **Published:** 2026-11-04T07:54:24Z
- **Last reviewed:** 2026-11-04T08:45:59.368Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5220
- **ID:** TL-2026-5220
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (1 shown free below)

## Description

WardenStealer is a Windows information stealer written in Rust and sold as a service on Russian-language forums (Exploit, XSS). Gen Digital (Gen Threat Labs) links it to the earlier CallbackBeaver malware through its Rust implementation, code-morphing functionality and specific cryptocurrency clipper configurations. The earliest builds appeared in May 2026, the forum listing in August 2026, and SpyCloud first saw it in its collection on 2026-08-03. Gen reports an in-house loader that runs in three modes (injection, DLL sideloading, standalone). The injection mode decodes a hidden payload with a per-build custom Base64-style alphabet and injects the rebuilt stealer into explorer.exe on a new thread. Loader files use heavy padding to evade AV scanning, and the stealer uses string encoding, dynamic API lookups, indirect jumps and junk-code insertion. It bypasses Chromium Application-Bound Encryption by locating encrypted master keys in browser memory and hijacking browser threads to decrypt them in place. It also includes a clipper covering ten cryptocurrency networks. C2 traffic is HTTPS with a custom binary format, with 1-5 hardcoded C2 domains per build and fallbacks, and the initial registration carries a system fingerprint (hardware ID, OS version, username, installed software). Gen reports pricing of $450/month (personal) and $1,500/month (enterprise), and the operators claim about 110 customers (unverified). Version 1.9 formalised AI token theft. Logs carry a 'Stealed by Warden' banner.

Aoki (also tracked as Aokigahara) is a Go-compiled Windows stealer. SpyCloud first saw it on 2026-10-04, with peak activity on 2026-10-13. Symantec's Threat Hunter Team reported on 2026-10-15 that it appears to be in active development. Check Point Research analysed it on 2026-10-23. Aoki stages stolen data in named top-level folders. An AISessions category holds per-tool subfolders for ChatGPT, Claude Code, the Microsoft Store build of Claude Desktop, Codex, GitHub Copilot and Cursor. Reports also name Gemini CLI, Windsurf, JetBrains AI Assistant, Kiro, Amazon Q and AWS sign-on data. Other categories include Browser, Games, Messengers and FTP. Symantec saw it target .claude.json, Claude desktop cookies, ChatGPT cookies and the Codex config.toml and .env files. Check Point and GridinSoft add auth.json, state databases, Git/SSH credentials and private keys, and AWS/Azure/GCP configuration, plus screenshots and clipboard contents. Exfiltration is ZIP archives encrypted with AES-GCM, uploaded with labelled headers per collection category. Execution flags depend on configuration, and there are optional language and environment checks. Temporary working files use the %TEMP%\akg_ prefix ('akg' refers to Aokigahara). The only published network indicator is the C2 domain neihite.cc. Neither SpyCloud nor Symantec attributes Aoki to a known group or malware family, and its cryptocurrency focus suggests a financial motive.

WardenStealer delivery relies on ClickFix paste-and-run lures, malicious search advertising, cracked software, fake game cheats and trojanized installers. SpyCloud found Claude Code OAuth credential files (access and refresh tokens) and Codex authentication material (an OpenAI API key plus access and refresh tokens) in WardenStealer logs. It also found Netscape-format session cookies, CLAUDE.md instruction files, MCP server credentials, account/machine identifiers and plan-usage history.

Impact: a token lifted from a developer's install carries that developer's access, and much of that access survives both a password reset and MFA prompts, because a password change does not invalidate credentials already issued. SpyCloud reports underground resale (for example a $100 Codex/Claude credit for $8.94, and 40-60% discounts on subscriptions). It also reports wholesale reseller commissions of 35% (Anthropic/AWS Bedrock Claude keys) and 20% (OpenAI keys), and feeds that post live OpenAI project keys with machine identifiers, hostnames, usernames and IPs. This feeds LLMjacking abuse. Defenders should treat AI-tool credentials as in scope for infostealer incidents: rotate exposed keys and tokens, revoke active sessions at every connected service, and watch for anomalous API usage.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1204.002 Malicious File
- T1583.008 Malvertising
- T1055 Process Injection
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1082 System Information Discovery
- T1550.004 Web Session Cookie
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1497.001 System Checks
- T1574.002 DLL Side-Loading
- T1115 Clipboard Data
- T1560.001 Archive via Utility

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Aoki (Aokigahara) akg_ Temp Files and AISessions Staging Folders — Post-Exploitation** (`TL-2026-5220-SPL-002`)

Detects Aoki/Aokigahara stealer staging of stolen data: files created with the %TEMP%\akg_ working prefix and files written under a top-level AISessions folder with per-tool subfolders (ChatGPT, Claude, Codex, GitHub Copilot, Cursor). Tags the AI tool being harvested so analysts know which tokens to rotate.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1074.001, T1005, T1552.001
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (TargetFilename="*\\Temp\\akg_*" OR TargetFilename="*\\AISessions\\*") | eval path_lc=lower(TargetFilename) | eval ai_tool=case(like(path_lc,"%aisessions%chatgpt%"),"ChatGPT", like(path_lc,"%aisessions%claude%"),"Claude", like(path_lc,"%aisessions%codex%"),"Codex", like(path_lc,"%aisessions%copilot%"),"GitHub Copilot", like(path_lc,"%aisessions%cursor%"),"Cursor", like(path_lc,"%aisessions%"),"AISessions-other", true(),"akg_temp_file") | stats count dc(TargetFilename) as file_count values(ai_tool) as ai_tools values(TargetFilename) as sample_files min(_time) as first_seen max(_time) as last_seen by host User Image | convert ctime(first_seen) ctime(last_seen) | table host User Image ai_tools file_count sample_files first_seen last_seen
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has "AISessions" or (FolderPath has @"\Temp\" and FileName startswith "akg_")
| extend AITool = case(FolderPath has "ChatGPT", "ChatGPT", FolderPath has "Claude", "Claude", FolderPath has "Codex", "Codex", FolderPath has "Copilot", "GitHub Copilot", FolderPath has "Cursor", "Cursor", FolderPath has "AISessions", "AISessions-other", "akg_temp_file")
| summarize FileCount = dcount(FolderPath), AITools = make_set(AITool), SampleFiles = make_set(FileName, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath
```

### Sigma

```yaml
title: Aoki Stealer akg_ Temp Files or AISessions Staging Folder
id: 1d9e6b37-82a4-4f0c-b5d3-6a7e2c9f0b02
status: experimental
description: Detects file creation matching the Aoki (Aokigahara) infostealer temp-file prefix akg_ in the user temp directory or an AISessions staging folder holding stolen AI-tool data.
references:
    - https://www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/
    - https://blog.gridinsoft.com/aokigahara-ai-sessions-developer-keys/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.collection
    - attack.t1074.001
    - attack.t1005
    - attack.credential_access
    - attack.t1552.001
logsource:
    category: file_event
    product: windows
detection:
    selection_akg:
        TargetFilename|contains: '\Temp\akg_'
    selection_ai:
        TargetFilename|contains: '\AISessions\'
    condition: 1 of selection_*
falsepositives:
    - Legitimate software that happens to use an akg_ temp prefix or an AISessions folder name
level: high
```

**Known false positives:**

- Unrelated software using an akg_ temp prefix (e.g. AKG audio tooling)
- Internal tools or backups that create a folder named AISessions

**Tuning notes:** Exclude known audio/AKG vendor software by Image path. Treat any hit with an ai_tool value as confirmed token exposure: rotate API keys, revoke OAuth sessions at ChatGPT/Claude/Codex/Copilot/Cursor. Temp-folder names may vary between Aoki builds, so also review ZIP staging (SIG-003).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Remote Thread or Memory Injection into explorer.exe from User-Writable Path — WardenStealer Loader (locked: unlock with TL Creds)
- Mass Access to AI-Tool, Browser and Developer Credential Stores by Non-Allowlisted Process — Token Theft (locked: unlock with TL Creds)
- Connections to Aoki C2 [indicator] and Community-Observed ClickFix/Malvertising Infrastructure — C2 (locked: unlock with TL Creds)
- ClickFix Command Recorded in Explorer RunMRU Registry Key — Execution (locked: unlock with TL Creds)
- Unsigned DLL Sideloaded by Executable in User-Writable Directory — WardenStealer Loader (locked: unlock with TL Creds)
- ZIP Archive Staged in Temp by Process Running from User-Writable Path — Aoki Exfiltration Staging (locked: unlock with TL Creds)
- WardenStealer ClickFix Paste-and-Run Shell Spawned by explorer.exe — Execution (locked: unlock with TL Creds)
- Aoki Stealer C2 Domain [indicator] DNS/Network Contact — Command and Control (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 15)

Defanged, TLP:CLEAR.

- Domain: `neihite[.]cc`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Use New Infostealer Malware to Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets](https://cybersecuritynews.com/hackers-use-new-infostealer-malware/)
- [SpyCloud: Infostealers Now Target AI Tokens and API Keys](https://spycloud.com/blog/infostealers-now-target-ai-tokens-and-api-keys/)
- [Infosecurity Magazine: New Aoki Infostealer Targets AI Coding Assistant Credentials (Symantec Threat Hunter Team)](https://www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/)
- [SecurityOnline: Warden Stealer Rust Infostealer (Gen Threat Labs analysis)](https://securityonline.info/warden-stealer-rust-infostealer/)
- [GridinSoft: Aokigahara Stealer Targets AI Sessions and Developer Keys (Check Point Research analysis)](https://blog.gridinsoft.com/aokigahara-ai-sessions-developer-keys/)
- [Dark Reading: 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants](https://darkreading.com/endpoint-security/aokigahara-stealer-developer-keyrings-ai-assistants)
- [Daily Security Review: Warden Stealer Rust Infostealer Targets AI Coding-Agent Tokens](https://dailysecurityreview.com/?p=44403)
- [Cyber Security News: New Aoki Malware](https://cybersecuritynews.com/new-aoki-malware/amp/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5220