Cybercriminals have shifted the focus of their attacks: they no longer need to brute-force passwords or look for vulnerabilities in the language models themselves. According to security experts at SpyCloud, over 130,000 unique infections by the WardenStealer malware have been recorded since August 2026, and its counterpart, Aoki, was discovered in October 2026. Both programs target developers and active artificial intelligence users, stealing ready-made authorization data—tokens, cookies, and configuration files—from standard folders on the infected computer.
Primary Targets
Among the main targets of the malware are services closely tied to the work of programmers and AI developers: Claude Code, OpenAI Codex, Cursor, GitHub Copilot, and the Claude and ChatGPT desktop applications. These very tools store valuable authentication materials on local machines—valid access tokens that allow logging into accounts without re-entering a password.
Two Programs, Two Sets of Techniques
WardenStealer is written in Rust for the Windows operating system and is distributed via a subscription model. In addition to browser data, crypto wallets, and messengers, it collects Claude Code tokens, Codex authentication materials, and Claude Desktop configurations. Aoki, discovered in October 2026, is developed in Go and features an engineering approach: it sorts stolen materials into a special AISessions folder, accumulating cookies and settings for ChatGPT, Claude, Codex, Copilot, and Cursor. Neither program requires finding new vulnerabilities in AI models—they simply copy valuable authorization files from expected directories.
The Main Risk: Session Hijacking
The critical danger is that a stolen valid token allows an attacker to restore authorized access without entering a password and without passing repeated two-factor authentication (MFA). In fact, the victim may not notice the compromise: the session continues to run, and the criminal uses it in parallel. Along with program settings and query history, hackers gain access to source code, internal systems, and confidential corporate information.
LLMjacking: Theft That Generates Profit
Hackers sell the hijacked data on shadow online marketplaces: offers to purchase AI service subscriptions and working credits at a discount have already appeared on the dark web. This scheme is known as LLMjacking—it allows criminals to use paid AI tools at the expense of other people and companies. According to Sysdig analysts, in a worst-case scenario, attackers can cause daily damage of over $46,000 to a company by utilizing stolen Claude resources.
How to Protect Yourself
Cybersecurity specialists recommend that developers check their devices for threats, terminate active sessions in AI services, and regularly update access keys. These measures reduce the likelihood that a stolen token remains valid and suitable for session hijacking.
