Info-stealing trojan hijacks Claude sessions and steals AI tool credentials

1. 14:41
   公众号Doonsec· Discussion

   Infostealer targets AI agents: Warden Stealer rises in three months, specifically stealing Claude and Cursor's "keys"(opens the original post in a new tab)

1. 01:31
   Gen Blogs

   Warden Stealer: a rapidly rising info-stealer targeting AI agent data

   Gen Threat Labs has published a technical analysis of Warden Stealer, noting that this Rust-written MaaS info-stealer is among the first to steal local data from AI assistants and agent coding tools, with targets including Claude, Codex, Grok, and Cursor. It can steal access and refresh tokens, credentials in MCP configurations, prompt history, and conversation databases, thereby gaining both account access and context on the value of the projects behind that data. Earlier collection of AI agent data came from operator-defined custom rules; starting with version 1.9 (announced September 29, 2026), official support was added for collecting AI coding agent tokens. It has been promoted on underground forums since August 2026, and the author says roughly 110 customers are currently using it; Gen says it has become one of the most popular info-stealers in its user base.

1. Time not given
   Hudson Rock 旗下 InfoStealers

   Hudson Rock discloses Russian-language MaaS infostealer Warden v1.9 targeting Claude Code and Codex CLI credentials

   Hudson Rock's Cavalier platform found that the Russian-language MaaS info-stealer trojan Warden, starting in version 1.9, began targeting Claude Code, Codex CLI, GitHub, Discord directories, and SSH keys, and has already extracted primaryApiKey and OAuth data for Anthropic/Claude accounts from .claude.json. Attackers use this to bypass web login and directly access paid AI models, organization workspaces, and source code that passed through these tools programmatically. Warden claims to use a custom morpher based on AST and LLVM IR to evade antivirus software, performs no decryption at runtime, and handles it server-side; samples are about 350kb and cover more than 360 applications across 13 categories. Developer interviews say the project began development in early 2026 and was made public on July 21; it currently has about 110 active users, with enterprise subscriptions up to $1,500 per month.

1. Date not given
   Security Affairs

   Info-stealing malware hijacks Claude sessions; Anthropic forces logout and issues refunds

   Anthropic has confirmed that multiple information-stealing malware families can hijack already logged-in Claude sessions, bypass passwords, MFA, and SSO, and consume paid credits. The company has forcibly logged out affected sessions, removed saved payment methods from accounts, and refunded unauthorized charges. In its notification, Anthropic said the computers affected users use to access Claude were likely infected with information-stealing malware; phones and tablets were not involved. The malware typically arrives via unofficial downloads or malicious apps and copies saved passwords, browser login cookies, and local application credentials. The company identified Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, as well as Atomic Stealer on a small number of Macs, and noted that revoking sessions or blocking fraudulent payments alone is not enough—while the device remains infected, the malware can capture the next login. Existing plans continue until the end of the current billing cycle, after which users must re-add a payment method. Anthropic recommends running a full malware scan before logging back in and changing passwords with two-factor verification enabled.

Current attention45·Peak in the comparable period48（Oct 12 15:00）·Change over the comparable past 24 hours +3%