Two families of Windows malware are now copying the login files of AI coding tools, and a password change may not lock the thief out. Security firm SpyCloud says WardenStealer and Aoki go after sign-in tokens and cookies for six products: Claude Code, Codex, Cursor, Copilot, and the desktop apps for Claude and ChatGPT.
The point for anyone who uses these tools is that a stolen token is a ready-made session. Whoever holds it can act as you without typing a password or answering a multi-factor prompt, until the token is revoked or expires.
SpyCloud’s research post, published on 30 October, is based on infection logs it recovered rather than on adverts for the malware. By its count, WardenStealer has infected over 130,000 distinct machines since the firm first saw it on 3 August. Aoki first showed up in its data on 4 October.
WardenStealer is a Rust program sold to criminals as a service. Its AI collection sits among dozens of other targets such as Discord, Steam and AnyDesk. From Claude Code, the logs held the credentials file it keeps on disk. That file carries the account’s tokens and those of any linked MCP servers, and the stolen set also included the user’s CLAUDE.md instructions. The Codex folder held an OpenAI API key next to its tokens.
Aoki, written in Go, files the material under a folder of its own. Each tool gets its own subfolder in Aoki’s logs, and some contain browser-style cookie files from the desktop apps. Those cookies are the most dangerous item, the firm says, because they resume a logged-in session directly.
This is theft from infected computers, not a breach at the AI companies. Delivery looks ordinary: fake “fix” pages that tell you to paste a command, poisoned search ads, pirated software, game cheats and tampered installers. SpyCloud says it could not pin Aoki to a single delivery method.
There is already a market for the loot. SpyCloud also watched underground shops sell AI plans and API credit at huge discounts, from 40% to 91% off. One catalogue offered a $100 Codex or Claude API key for just $8.94. A reseller panel pays whoever uploads a working Claude key up to 35% of the bills it runs up. SpyCloud admits it cannot prove every key on sale came from malware rather than phishing or leaked secrets.
The advice for developers is practical: if a machine may have been infected, clean it first, then revoke active sessions, rotate API keys and tokens, and watch the usage dashboards for charges you did not make. Changing the password alone is not enough. Gen Digital and Symantec have also documented AI-credential theft by stealers, so the technique is not limited to these two.
