WardenStealer and Aoki Infostealers Steal Claude Code and Codex Tokens: What SpyCloud Found

Two Windows infostealers, WardenStealer and Aoki, are collecting the local credential files of Claude Code, Codex and other AI tools, according to a SpyCloud research report dated October 30, 2026. The files hold OAuth tokens, refresh tokens and an OpenAI API key, and some of them keep working after you change your password. No vendor was breached: the malware has to be running on your machine first. If it was, revoke sessions and rotate keys from a clean device.

This post covers what SpyCloud found in recovered infection logs, what each family takes, what the stolen access is worth on underground markets, and a checklist for developers who run coding agents. It also draws on Cyber Security News' summary published November 4.

TL;DR

What did SpyCloud actually find?

SpyCloud did not start from malware advertisements or a code teardown. It examined infection logs it had recovered, the files a stealer uploads from each victim, and looked at what was inside. That makes this a report on what was stolen, not only on what the malware could do.

Key facts from the report, as relayed in the coverage:

• WardenStealer is a Rust-based Windows stealer sold through a malware-as-a-service model. SpyCloud first observed the family on August 3, 2026 and says it has ingested more than 130,000 unique infections. Gen Digital tracks the same family as CallbackBeaver, with first builds in early May 2026.
• Aoki is a Go-compiled Windows stealer first seen on October 4, 2026, peaking around October 13. Symantec published its own analysis on October 15, and SpyCloud notes there are no known family links or attributed group.
• Both families sweep up the usual stealer targets (browser passwords, cookies, messaging data, crypto wallets) and, in addition, local AI application files.

Aoki is the same family that Check Point Research calls Aokigahara, whose aisessions module we covered on October 27; the shared command-and-control domain neihite[.]cc appears in both write-ups. What is new here is WardenStealer, the scale figure, and the look at what real logs contain and what the stolen access sells for.

Which AI files do they take?

SpyCloud found these in analysed WardenStealer logs, stored as subfolders of a general Applications folder:

Gen Digital reports, per SpyCloud, that the AI collection was first added through custom rules and then folded into the standard build in version 1.9 on September 29, 2026. In other words, it is now a default behaviour for buyers of the service, not a bespoke add-on.

Aoki is more organised. Its logs have top-level folders for Browser, Games, Messengers, FTP and AISessions, with per-tool subfolders for ChatGPT, Claude Code, Claude Desktop (the Microsoft Store build), Codex, GitHub Copilot and Cursor. Some hold Netscape-format cookie files for web-backed desktop apps. SpyCloud's samples write working files under a %TEMP%\akg_ prefix and beacon to neihite[.]cc.

SpyCloud does not say how either family reaches a machine. Earlier reporting on WardenStealer mentions ClickFix lures, malicious ads, cracked software and fake game cheats, and for Aoki the likely channels are commodity ones. Treat those as plausible, not confirmed.

Why a password reset does not fix it

An AI account is not protected by one secret. Several credentials sit on disk, each doing a different job:

1. Access token. Authorises requests right now. Short-lived, but valid until it expires.
2. Refresh token. Gets replacement access tokens, so it can extend an attacker's access well beyond the first token's life.
3. API key. Lets software spend your paid quota from anywhere. Often long-lived.
4. Session cookie. Resumes an existing signed-in session without the password and without a fresh MFA prompt.
5. MCP server tokens. In Claude Code's credentials file, these authorise connected tools and services, not just the model account.

Changing a password does not necessarily invalidate any of these. Whether it does depends on the provider, the token type and the account controls, so the reliable response is explicit revocation and rotation, not another password. This is endpoint credential theft, which means the attacker is acting as an already-authenticated you.

What is the stolen access worth?

SpyCloud also looked at where this material shows up for sale, and it already has buyers:

• A one-month Codex API key with $100 of credit was offered for $8.94.
• Claude, ChatGPT and Grok subscriptions were advertised at 40 to 60 percent below list price.
• One Telegram bot offered OpenAI and Anthropic access up to 91 percent below official pricing, with deposits from $1.
• Wholesale services pay suppliers a share when uploaded keys generate billable usage: 35 percent of billings for Anthropic and AWS Bedrock Claude keys and 20 percent for OpenAI keys, paid daily.
• Automated feeds post live OpenAI keys alongside machine ID, hostname, username and IP, and inbox checkers flag mailboxes with Anthropic sign-in messages.

SpyCloud cautions that it could not establish whether every advertised credential came from stealers rather than phishing, exposed secrets or fraudulent signups. Still, the pattern is LLMjacking: criminals consume AI services on someone else's account, and the owner finds out from the bill. We covered the same economy in Google's report on LLM mixers and stolen keys and Wiz's work on LLMjacking and stolen keys. For historical scale, SpyCloud cites Sysdig's 2024 figure of a single abused account exceeding $46,000 a day.

There is an enterprise angle too. A stolen CLAUDE.md or MCP config tells an attacker which repositories, cloud services and build systems a developer's agent reaches, which is useful reconnaissance even if the tokens expire.

What this means if you run AI coding agents

First, check whether you were exposed.

1. Look for indicators on Windows machines: working files under %TEMP%\akg_*, DNS or proxy traffic to neihite[.]cc, and any endpoint-protection detection named WardenStealer, CallbackBeaver or Aoki. SpyCloud published no file hashes, so network and endpoint telemetry is what you have.
2. Search your logs for the domain, and treat any hit as a confirmed compromise.
3. In each AI service, Git host and cloud console, review recent logins, token creations and usage you do not recognise. Unexpected API spend is the most common visible symptom.

If you suspect infection:

1. Isolate the device.
2. From a clean device, sign out of all active sessions in each AI account and revoke the Claude Code and Codex logins. Rotate any OpenAI or Anthropic API keys that lived on the machine.
3. Re-authorise MCP servers that Claude Code was connected to, since their tokens sat in the same file.
4. Rotate Git tokens, SSH keys and cloud credentials the stolen configs point to, then review repositories and cloud accounts for actions you did not take.
5. Rebuild the machine before signing back in. Our first 24 hours after a vendor breach runbook gives a rotation order.

To reduce what a stealer finds next time:

• Prefer short-lived logins you can revoke over permanent API keys sitting in .env or config files.
• Set spending limits and usage alerts on API keys, so abuse shows up in hours rather than at month end.
• Keep MFA on AI, Git and cloud accounts, and scope tokens to least privilege.
• Be careful where installers come from: stealers spread through fake software, as in fake Claude Code installers.
• Treat AI credentials as in scope for every developer-machine infostealer investigation, which is SpyCloud's own recommendation.

Claimed versus confirmed

What Beam can and cannot do here

Beam does not stop this malware. WardenStealer and Aoki are separate processes on the operating system, not agent actions, and Beam is not antivirus, endpoint detection or a kernel sandbox. It cannot tell you whether a stealer ran on your machine.

What it does cover is the agent side of the same exposure. It flags risky agent actions such as credential exposure and can deny them through Claude Code and Codex PreToolUse hooks, and it redacts known credential formats before storing anything (pattern-based, so not complete). Everything stays on your device. See how Beam works and what stays local, and for the broader pattern, where API keys leak from env vars and logs.

Frequently asked questions

What are WardenStealer and Aoki?

Both are Windows infostealers. WardenStealer is a Rust-based malware-as-a-service family that SpyCloud first saw on August 3, 2026; Aoki is a Go-compiled stealer first seen on October 4, 2026. SpyCloud found Claude Code, Codex and other AI tool files in logs from both.

Were Anthropic or OpenAI breached?

No. SpyCloud and the coverage describe endpoint credential theft: the malware reads files on an already infected computer. Nothing in the reporting shows a service-side breach at Anthropic, OpenAI or any other vendor.

Why does changing my password not help?

Access tokens, refresh tokens, API keys and session cookies are separate credentials issued earlier. Whether a password change invalidates them depends on the provider and token type, so you need to revoke sessions and rotate keys explicitly.

Which files were taken?

SpyCloud lists the Claude Code OAuth credentials file (access and refresh tokens plus MCP server tokens), the Claude Code account config, CLAUDE.md, the Codex auth file (an OpenAI API key plus tokens), and Claude Desktop config and usage history. Aoki also sorts Copilot, Cursor and ChatGPT material into an AISessions folder.

What should I do if I might be infected?

Isolate the machine, then from a clean device revoke active AI sessions, rotate API keys and OAuth tokens, review unusual API usage, and check which source control, cloud and build systems the stolen configs reveal. Rebuild the machine before signing in again.

Can Beam stop this malware?

No. Beam watches and can deny risky actions by supported agents, but it is not antivirus or endpoint detection and cannot see a separate process reading your credential files.

Related reading

• Aokigahara infostealer: Claude Code, Codex and Cursor credentials
• NIK C2 malware falls back to your OPENAI_API_KEY
• VOLTA infostealer: an LLM ranks victims by SSH keys and cloud configs
• November 2026 attacks timeline
• Sources: SpyCloud (primary), Cyber Security News (summary), Check Point Research (Aoki/Aokigahara analysis)

Details are accurate as of November 4, 2026, based on SpyCloud's October 30 report. Counts, indicators and attribution may change; check the original report for updates.