aiqbench analysis
This report describes infostealer malware that targets session tokens and credentials from AI assistants like Claude Code and Codex, including connected MCP servers and API keys. The risk extends beyond chatbot access, since developers often link these tools to repositories, cloud services, and build pipelines. Readers building or deploying AI tools should treat local assistant credentials as sensitive secrets, because sessions may stay valid after a password reset.
Hackers Use New Infostealer Malware to Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets
Hackers are expanding information theft beyond saved passwords, targeting authentication tokens and session data stored by ChatGPT, Claude, Codex, and other AI tools. Two Windows malware families, WardenStealer and Aoki, collect credentials that may remain usable after a password reset, leaving victims exposed even after they believe their accounts are secured. The danger extends beyond […] The post Hackers Use New Infostealer Malware to Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets appeared first on Cyber Security News.
Hackers are expanding information theft beyond saved passwords, targeting authentication tokens and session data stored by ChatGPT, Claude, Codex, and other AI tools. Two Windows malware families, WardenStealer and Aoki, collect credentials that may remain usable after a password reset, leaving victims exposed even after they believe their accounts are secured. The danger extends beyond unauthorized chatbot access. Developers often connect AI assistants to source repositories, cloud services, and build…
Excerpt shown under the publisher's RSS terms · 70 words · full text and figures are on the publisher's site
Related coverage
Python MaaS Infostealer Builder Steals Passwords, Credit Cards and Cookies From 17 Browsers
Cybersecurity News · Sep 28, 2026
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz · Sep 25, 2026
Hackers Turn Fake Games Into Multi-Stage Infostealers That Steal Passwords and Crypto Wallets
Cybersecurity News · Jul 21, 2026
“Don’t Make It Easy for Them”: The Four Basics Lower the Odds, Recovery Readiness Decides the Outcome
Cybersecurity News · Oct 28, 2026