Password-Stealing Malware Now Takes Your AI Tool Logins Too. A Password Reset Will Not Fix It.

Infostealers are a common kind of malware. They arrive with a pirated program, a fake installer or a booby-trapped download, copy saved passwords and browser cookies from the computer, and sell them. On 30 October the security firm SpyCloud reported that two of them now go after something newer: the logins of AI tools.

What SpyCloud found

• WardenStealer, first seen in SpyCloud's data on 3 August 2026, with more than 130,000 infections attributed to it since. Collecting AI tool data became a standard feature in its version 1.9, announced on 29 September.
• Aoki, first seen on 4 October 2026. It stores what it takes in a dedicated AISessions folder.
• From Claude Code: the credentials file with its access and refresh tokens, including tokens for connected MCP servers, plus the account configuration and the CLAUDE.md instruction file.
• From Codex: the authentication file, which holds an OpenAI API key and tokens.
• From Claude Desktop, ChatGPT desktop, GitHub Copilot and Cursor: configuration, cookies or token files, depending on the malware.

SpyCloud also found a market for the result. Underground shops sell AI access at 40% to 91% below list price. One catalogue offered $100 of Codex API credit for $8.94. One service pays sellers 35% of what it bills for uploaded Anthropic keys. Somebody else's stolen login is the cheap supply.

Why a password reset does not help

When you log in to an AI tool, it keeps a token on your computer so you do not have to log in again every time. Whoever copies that token is, as far as the service can tell, already logged in. SpyCloud puts it plainly: much of that access "survives both the password reset and the multi-factor prompt that would stop a reused credential." An API key works the same way. It does not care what your password is.

This has already happened at scale. In August Anthropic emailed Claude users whose login sessions had been stolen by infostealers, used to burn through their usage while they were away. Anthropic signed them out, revoked the sessions and refunded unauthorised charges, and warned that signing out does not remove the malware: "If it's still on your computer, your next login session could be stolen the same way."

If a computer that runs AI tools may be infected

Order matters. Rotating keys on a machine that is still infected just hands the attacker the new ones.

1. Clean the computer first. Disconnect it, run a full scan with up-to-date security software, and if anything is found, consider reinstalling. Do not log in to anything from it until it is clean.
2. From a different, clean device, sign out everywhere. Each AI provider's account settings lets you end all active sessions. Do it for Claude, ChatGPT, GitHub and any other tool the machine was logged in to.
3. Replace every API key that lived on that machine. Revoke the old keys in each provider's dashboard and create new ones. Check the provider's usage page for requests nobody on your team made.
4. Reconnect the services your AI tools were linked to. Connected MCP servers hold their own tokens. If the coding tool could reach GitHub, a database, a cloud account or a ticketing system, revoke and reissue those connections too.
5. Change the passwords as well. It is not enough on its own, but the same malware took the browser's saved passwords at the same time.

Habits that limit the damage next time

• Set a spending limit and an alert at every AI provider. A stolen key then shows up as an email, not an invoice.
• One key per person and per tool. When something leaks, you replace one key and know where it came from.
• Keep production credentials off laptops. The AI tool on a developer's machine should not hold the keys to the live database or the payment account.
• Install AI tools only from the vendor's own site, never from a search ad, a download mirror or a link in a message.
• Treat instruction files as readable. CLAUDE.md and similar files were taken too. Never put passwords or keys in them.

Sources

• SpyCloud Labs (Trevor Hilligoss), IntelStealers: the infostealers going after AI tokens and AI configuration data, 30 October 2026. WardenStealer and Aoki dates, 130,000+ infections, version 1.9, files collected per tool, the AISessions folder, underground prices and payouts, the password-reset quote and the recommended response.
• BleepingComputer, Anthropic warns infostealer malware is hijacking Claude sessions to drain usage, 30 August 2026. Anthropic's email to affected users, the actions it took and the quote about the next session being stolen.