Recently discovered malware strains are targeting more than just passwords—attackers are now harvesting AI authentication tokens that remain valid even after victims change their passwords. Malicious software families called WardenStealer and Aoki are being used to siphon tokens and session data from tools like ChatGPT, Claude, Codex, GitHub Copilot, and Cursor. These credentials bypass the usual password reset defenses, exposing users long after they think they’ve secured their accounts.
Malware That Collects AI Credentials
WardenStealer, developed in the Rust programming language, operates as a malware-as-a-service offering. It not only captures browser passwords and cookies but also mines data from installed AI applications—ranging from API keys to session tokens and configuration files. Victims’ files often reveal OAuth access and refresh tokens, standing instructions for the AI assistance tools, and information that links to software developer pipelines. These tools often integrate with sensitive environments like source code repositories and cloud deployments, making this malware especially dangerous.
Aoki takes a similarly deep approach but organizes what it steals into dedicated folders. This malware has been observed gathering data from both desktop and browser-based AI tools. Along with credentials for some of the most widely used models, it can harvest session cookies which allow attackers to maintain access without triggering MFA or password checks.
Why Password Resets Aren’t Enough
Tokens—access tokens, refresh tokens, and API keys—operate independently of passwords. When attackers obtain these credentials, a password change may not disable previously issued tokens, letting malicious actors remain authenticated. The only reliable remedy is to revoke tokens and rotate keys. For organizations, that means rethinking incident response: not just resetting passwords, but also reviewing connected services and invalidating any credentials that might still be able to grant access.
Financial and Organizational Fallout
There is already a thriving underground market for stolen AI access. Offers circulating include subscriptions and API credits for popular tools at steep discounts, indicating active resale of credentials obtained through malware. These transactions support LLMjacking campaigns, in which attackers exploit another’s account to consume paid AI services. For businesses and developers, leaks of configuration files, project histories, and AI session data can spill critical information about internal systems and workflows.
Incident responders are urged to scan for signs of both WardenStealer and Aoki infections. Security operations teams should monitor indicators of compromise like AISessions folder usage and suspicious temporary file prefixes, revoke exposed tokens and keys, and review all active sessions.
Understanding what’s happening here reshapes how secure we truly are: it’s no longer about passwords alone. AI systems are becoming a new front in cybersecurity. As more work—and more risk—moves into tools driven by large language models and automation, the integrity of every token and session file counts. Organizations need to treat these artifacts with the same urgency they do passwords.
