Infostealers now grab Claude Code and Codex logins. Know where your tokens live and how to kill them

Published November 4, 20265 min read

SpyCloud's October 30 report, by Trevor Hilligoss, is based on infection logs the company recovered. Its main advice is one sentence: “Treat AI tool credentials as in scope for any infostealer investigation on a developer's machine.” Cyber Security News covered it on November 4.

This isn't a breach at Anthropic, OpenAI, or GitHub. It's ordinary endpoint malware that has learned where coding agents keep their logins. We haven't handled any samples; the details below come from SpyCloud, Gen Digital, and each vendor's own docs.

What the two stealers take

Both families run on Windows. They spread the usual ways: Gen Digital's Warden Stealer analysis lists “supposedly cracked software, game cheats, malvertising, and ClickFix campaigns,” where a web page tricks you into pasting a command into a terminal or the Run dialog.

SpyCloud counts more than 130,000 unique WardenStealer infections since August 3. That figure covers every infection, including ones where no AI tokens were taken. The report also names two more families, Remus and Amatera, that Gen Digital found collecting AI-agent data.

Why a token is worse than a password

A refresh token lets the holder get new access tokens without your password or an MFA prompt. Changing your password doesn't necessarily cancel tokens that were already issued, so the usual “reset the password” response can leave the attacker signed in.

There's a market for this access. SpyCloud found underground shops selling AI model access at 40% to 91% below list price, which it says “strongly suggests” stolen keys. One wholesale service reportedly pays 35% of billings for Anthropic and Amazon Bedrock Claude keys. If your organization pays per token, a stolen key is a bill as well as a breach.

The CLAUDE.md theft matters too. An instruction file often names internal hosts, deploy commands, and which MCP servers the agent can reach. Together with the MCP tokens, it tells an attacker exactly what the stolen credentials open.

Where each tool keeps its login

Both stealers target Windows, and that's where the defaults are weakest. From each vendor's docs:

Sources: Claude Code authentication docs, Codex authentication docs, and Copilot CLI authentication docs. OpenAI's page says it plainly: “treat ~/.codex/auth.json like a password: it contains access tokens.”

A keychain isn't a full defense against malware that runs as you. It does mean a stealer has to do more than copy a known file. SpyCloud doesn't say which Copilot or Cursor files Aoki took, so don't assume a keychain default kept you safe.

If a machine was infected: revoke, don't just log out

Logging out locally deletes the file on that machine. It doesn't touch the copy the attacker already has. Revoke on the server, from a clean device:

• Claude Code with a claude.ai login. In claude.ai, go to Settings, then Claude Code, and delete the authorization token. To end everything, use Settings, then Account, then Log Out of all sessions. Anthropic's support article says this also logs out Claude Code, including tokens created with claude setup-token, but “doesn't affect your API keys.”
• Claude Console API keys. Rotate them in the Console. Check usage for spend you don't recognize.
• Codex. Rotate any OpenAI API key that was in auth.json. The Codex docs point to their Access tokens page for revoking Codex access tokens.
• Copilot CLI. The docs warn that /logout “removes the locally stored token but does not revoke it on GitHub.” If you signed in through the CLI's OAuth flow, revoke GitHub Copilot CLI under GitHub Settings, Applications, Authorized OAuth Apps. If it used a fine-grained personal access token, delete that token under Developer settings. If it used your GitHub CLI login, revoke GitHub CLI in the same Authorized OAuth Apps list.
• MCP servers. WardenStealer takes the MCP tokens in Claude Code's credentials file. Revoke the agent's grant in each connected service, such as your issue tracker or cloud console.

Then do the browser work an infostealer response always needs: passwords, session cookies, and wallets. Our Cursor extension backdoor guide covers rotating from a separate machine in more detail.

What to change before it happens

• Codex users: switch to the keychain. Set cli_auth_credentials_store = "keyring" in Codex's config. It fails if no credential store exists, which is the behavior you want on a laptop.
• Keep long-lived tokens off laptops. claude setup-token issues a one-year token. Put it in your CI secret store and keep it out of shell profiles on developer machines.
• Use short-lived keys where you can. Claude Code's apiKeyHelper setting runs a script that returns a key, so it can fetch short-lived credentials from a vault instead of reading a stored one.
• Keep secrets and hostnames out of CLAUDE.md and AGENTS.md. Assume anything in an instruction file will be read by someone else.
• Watch usage. A sudden jump in token spend on a key is often the first sign it's been sold.
• Teach the ClickFix pattern. No real CAPTCHA or verification check asks you to paste a command into Run or a terminal. Treat any pop-up asking you to run a command as hostile, and copy install commands only from a vendor page you opened yourself.

This is the same lesson as the OpenCode Console breach and the LiteLLM token theft. A coding agent's login now opens model spend, connected tools, and often a description of your infrastructure. Treat it like a cloud credential.

What we don't know

The reports don't give exact file paths for every tool, and they don't say whether macOS or Linux builds exist. SpyCloud doesn't say how many logs contained AI tokens. Anthropic, OpenAI, GitHub, and Cursor haven't published statements about this campaign.

Sources

• SpyCloud: IntelStealers (October 30, 2026): families, targeted tools, infection counts, market prices, and recommendations.
• Gen Threat Labs: Warden Stealer analysis (October 8, 2026): distribution and the version 1.9 announcement.
• Cyber Security News (November 4, 2026): coverage of the SpyCloud report.
• Claude Code docs: Authentication: credential storage, setup-token, and apiKeyHelper.
• Claude Help Center: Log out of all active sessions.
• Codex docs: Authentication: auth.json and credential store options.
• GitHub Docs: Authenticate Copilot CLI: token storage and revocation.