{"slug": "spycloud-finds-ai-tool-tokens-in-infostealer-logs", "title": "SpyCloud Finds AI-Tool Tokens in Infostealer Logs", "summary": "SpyCloud reported on October 30 that infostealer logs from the WardenStealer and Aoki malware families contain credentials for local AI coding tools, including Claude Code OAuth access and refresh tokens, tokens for connected Model Context Protocol servers, and an OpenAI API key plus Codex access and refresh tokens. SpyCloud said it has ingested more than 130,000 unique WardenStealer infections since first observing the family on August 3, 2026, a figure it cautioned is not a count of compromised AI accounts. The security firm advised treating AI-tool credentials as in scope for incident investigations, rotating exposed keys and tokens, revoking active sessions and watching for anomalous API use.", "body_md": "A developer cleaning up an infected computer has more to check than saved passwords. In an [October 30 report](https://spycloud.com/blog/infostealers-now-target-ai-tokens-and-api-keys/), SpyCloud describes recovered malware logs containing the digital keys used by local AI coding tools. Its advice is to include those tools in the investigation, rotate exposed credentials and revoke active sessions.\n\nThe security firm examined logs from WardenStealer and Aoki, two families of infostealers: malware that collects data from an infected machine and sends it away. The useful finding is the specific inventory. An account password, a token granting access and a file describing the developer’s environment are different things. A response that checks only one category can overlook material the report says these stealers collect.\n\nIn the WardenStealer logs it analyzed, SpyCloud found Claude Code’s OAuth credentials file. This file held access and refresh tokens used to obtain or maintain delegated account access. It also held tokens for connected [Model Context Protocol (MCP)](https://forkast.news/glossary/model-context-protocol-mcp/) servers, through which AI tools connect to other services. These are distinct credentials inside the file, and the connected-service tokens belong in the inventory alongside the main account’s tokens.\n\nSpyCloud’s WardenStealer inventory also includes:\n\n- **Codex authentication material:** an OpenAI API key plus access and refresh tokens. The key is a credential for requests to the service, not the account password.\n- **Claude Code configuration:** user and machine identifiers, plus the CLAUDE.md file that supplies standing instructions.\n- **Claude Desktop data:** configuration and plan-usage history.\n\nAoki arranged AI-tool material in a separate AISessions folder, SpyCloud says. Its tool-specific subfolders covered ChatGPT, Claude Code, the Microsoft Store build of Claude Desktop, Codex, GitHub Copilot and Cursor. The reported contents included credentials, configuration, Copilot and Cursor token files, and cookies for web-backed tools. These are observations from the logs SpyCloud analyzed, not a claim that every infection exposed every item.\n\nConfiguration needs a separate place on that list. SpyCloud says instruction files such as CLAUDE.md and MCP configuration can describe the environment a stolen token reaches into. They are context, not credentials themselves. Their presence in a log should not be mistaken for evidence that an attacker successfully used them to control another system.\n\nSpyCloud says it has ingested more than 130,000 unique WardenStealer infections since first observing the family in its collection on August 3, 2026. This figure is **not a count of compromised AI accounts**, and it does not establish how common AI-tool credential theft is across all developers.\n\nForkast’s earlier [Microsoft 365 token-replay coverage](https://forkast.news/microsoft-365-token-replay-attacks-compromise-97-accounts-at-79-organizations/) explained why a password change need not remove every route back into an account. Its [AgentBaiting reporting](https://forkast.news/agentbaiting-how-800-fake-ai-skills-deliver-malware-at-scale/) covered how fake skills distribute malware. SpyCloud’s report focuses instead on what local AI-tool material appears in stolen data after a machine is infected. It does not establish a connection to either prior campaign.\n\nSpyCloud recommends: “Treat AI-tool credentials as in scope for the investigation.” Its response list is concrete: rotate exposed keys and tokens, revoke active sessions, and watch for anomalous API use. The task is to account for each kind of access the infected machine held, rather than treating a changed password as the complete cleanup.", "url": "https://wpnews.pro/news/spycloud-finds-ai-tool-tokens-in-infostealer-logs", "canonical_source": "https://forkast.news/spycloud-finds-ai-tool-tokens-in-infostealer-logs/", "published_at": "2026-10-30 23:16:56+00:00", "updated_at": "2026-10-30 23:17:51.838586+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-agents", "agent-protocols"], "entities": ["SpyCloud", "WardenStealer", "Aoki", "Claude Code", "Model Context Protocol", "OpenAI", "Codex", "GitHub Copilot"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/spycloud-finds-ai-tool-tokens-in-infostealer-logs", "markdown": "https://wpnews.pro/news/spycloud-finds-ai-tool-tokens-in-infostealer-logs.md", "text": "https://wpnews.pro/news/spycloud-finds-ai-tool-tokens-in-infostealer-logs.txt", "jsonld": "https://wpnews.pro/news/spycloud-finds-ai-tool-tokens-in-infostealer-logs.jsonld"}}