News
threat-intel China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware - GBHackers threat-intel Apple to Scan Publicly Shared iCloud Photos and Files for Harmful Content Starting With iOS 27.3 - GBHackers threat-intel Hackers Develop New HYFLOCK Ransomware That Encrypts Files and Attempts to Block Recovery - GBHackers threat-intel ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks - GBHackers cybersecurity Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day - SecurityWeek cybersecurity Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes - SecurityWeek cybersecurity Hackers Exploit Sogou Input Method Vulnerability to Install DarkVigil Spyware on Windows Computers - CyberPress cybersecurity Apple to Scan Publicly Shared iCloud Photos and Files for Harmful Content in iOS 27.3 - CyberPress cybersecurity HYFLOCK Ransomware Encryption Flaw Lets Researchers Recover Data Without a Decryption Key - CyberPress cybersecurity 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 - The Hacker News threat-intel Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies - GBHackers cybersecurity Hackers Use ARTEX AI Framework to Target Seven South Korean Banks, Exposing Thousands of Customers - CyberPress cybersecurity OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks - SecurityWeek ai A new bill could change how the US builds energy infrastructure - MIT Technology Review cybersecurity GhostMap Android flaw lets malicious app trigger persistent boot loop - BleepingComputer
1 / 15
All news ›
Cybersecurity

IntelStealers: the infostealers going after AI tokens and AI configuration data

Pro CISO ·

Infostealer malware families such as WardenStealer and Aoki are now collecting configuration files, OAuth tokens, API keys and session cookies from AI coding tools like Claude Code, Codex, Cursor, GitHub Copilot and the Claude and ChatGPT desktop apps. Because these tokens often survive password resets and MFA prompts, they can grant access to source control, cloud accounts and build pipelines. SpyCloud says underground markets already sell AI access at steep discounts, which drives LLMjacking. Security teams should treat AI tool credentials as in scope for infostealer investigations, rotating exposed keys and revoking sessions.

Continue on spycloud.com ↗ ‹ All news Get the newsletter

The summary and image come from Pro CISO; the image is shown from their website.