Infostealers Are Actively Hunting AI Agents and Developer Keys - Warden Infostealer
www.infostealers.com
Perhaps the most alarming update (v1.9) is Warden's explicit targeting of AI coding agents and developer environments. As evidenced by leaked payload folders, the malware actively targets directories for Claude Code, Codex CLI, Discord, GitHub, and SSH Keys.

Original Reddit post

Log extractions (such as a compromised .claude.json file) show the stealer successfully exfiltrating raw primaryApiKey values and detailed OAuth account data tied to Anthropic/Claude accounts. By grabbing these CLI tokens, attackers are bypassing traditional web logins entirely, gaining direct, programmatic access to premium AI models, organizational workspaces, and potentially sensitive source code passing through these tools. submitted by /u/Malwarebeasts

Originally posted by u/Malwarebeasts on r/ArtificialInteligence