Cybercriminals Expand Infostealer Malware to Target AI Coding Assistants
Cybercriminals are increasingly adapting information-stealing malware to harvest sensitive data from AI-powered coding assistants, including Claude, Cursor, Codex, Cline, Continue, and OpenCode. This shift places developer credentials, Model Context Protocol (MCP) configurations, prompt histories, project metadata, and proprietary source code at risk assets now funneled into the same theft pipelines long used for browser cookies, cryptocurrency wallets, and password stores.
Key Threats and Attack Vectors
On Windows, malware families like Amatera (targeting Cline and Continue) and Remus (focusing on Claude, Cursor, and OpenCode) have been detected among tens of thousands of users over a three-month period. While these figures reflect detections rather than confirmed infections, they highlight the growing trend. CallbackBeaver has also expanded its scope to include Claude and Cursor, with researchers observing over 5,000 samples in a 30-day period. Other infostealers BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer demonstrate that AI-agent targeting is spreading across the malware ecosystem.
On macOS, Djinn Stealer has been linked to the collection of local data from Claude, Codex, Gemini, Cline, OpenCode, and Kilo.
Why AI-Agent Data Is Valuable to Attackers
Stolen AI-agent data provides attackers with access tokens, refresh tokens, account identifiers, subscription details, conversation histories, and project configurations. A compromised access token could allow attackers to consume paid AI-service capacity or hijack accounts, while refresh tokens may extend unauthorized access. More critically, MCP configurations which enable AI agents to connect with external tools and enterprise systems may expose API keys, endpoints, authorization headers, and credentials for source-control platforms, cloud services, databases, and collaboration tools.
Prompt histories pose another risk, as developers frequently use coding assistants to analyze logs, review code, troubleshoot incidents, and summarize internal documentation. These records may inadvertently reveal internal hostnames, repository structures, security controls, customer data, or trade secrets, serving as pre-collected reconnaissance for follow-on attacks like spear-phishing, extortion, or account takeovers.
How Attackers Are Scaling the Threat
Many infostealers operate with dynamic collection rules, allowing operators to update target directories, filenames, and file extensions without redistributing malware. Once a new AI tool gains popularity, existing infections can begin harvesting its data after a simple configuration change. This flexibility has contributed to a broader surge in infostealer activity Gen Digital recorded over 3.3 million unique detections in the first half of 2026, with monthly totals exceeding 500,000.
Remus, a Lumma Stealer variant, exemplifies the technical sophistication behind these attacks. It employs string obfuscation, anti-VM checks, syscall handling, and indirect control-flow obfuscation, along with an Application-Bound Encryption bypass. Its command-and-control infrastructure relies on Ethereum smart contracts for EtherHiding-based resolution, making it more resilient than traditional dead-drop mechanisms.
Broader Implications
The expansion of infostealer malware into AI-agent data underscores a critical shift: attackers are exploiting the predictable local storage of high-value credentials and configurations on already-compromised endpoints. Organizations must now treat AI-agent files as part of their identity and access attack surface, requiring inventorying deployments, securing credential storage, and rotating exposed tokens following a breach. While multi-factor authentication remains essential, it may not prevent abuse if an attacker has already stolen an active session token.
Source: https://gbhackers.com/infostealers-target-ai-tools/
OpenAI cybersecurity rating report: https://www.rankiteo.com/company/openai
Anthropic cybersecurity rating report: https://www.rankiteo.com/company/anthropicresearch
Open Code Mission cybersecurity rating report: https://www.rankiteo.com/company/open-code-mission
Continue (acquired by Cursor) cybersecurity rating report: https://www.rankiteo.com/company/continuedev
"id": "OPEANTOPECON1788942323",
"linkid": "openai, anthropicresearch, open-code-mission, continuedev",
"type": "Cyber Attack",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Tens of thousands of users '
'(Windows); unspecified (macOS)',
'industry': ['Software Development', 'Technology'],
'type': 'AI-powered coding assistant users'}],
'attack_vector': ['Local storage exploitation',
'Dynamic collection rules',
'Ethereum smart contracts for C2 resolution'],
'data_breach': {'data_exfiltration': True,
'personally_identifiable_information': ['Account identifiers',
'Developer '
'credentials'],
'sensitivity_of_data': 'High (trade secrets, internal '
'documentation, customer data)',
'type_of_data_compromised': ['Credentials',
'Configuration files',
'Prompt histories',
'Project metadata',
'Source code',
'API keys',
'Session tokens']},
'description': 'Cybercriminals are increasingly adapting information-stealing '
'malware to harvest sensitive data from AI-powered coding '
'assistants, including Claude, Cursor, Codex, Cline, Continue, '
'and OpenCode. This shift places developer credentials, Model '
'Context Protocol (MCP) configurations, prompt histories, '
'project metadata, and proprietary source code at risk, '
'funneling these assets into theft pipelines long used for '
'browser cookies, cryptocurrency wallets, and password stores.',
'impact': {'data_compromised': ['Developer credentials',
'MCP configurations',
'Prompt histories',
'Project metadata',
'Proprietary source code',
'Access tokens',
'Refresh tokens',
'Account identifiers',
'Subscription details',
'API keys',
'Endpoints',
'Authorization headers',
'Credentials for source-control platforms',
'Cloud services',
'Databases',
'Collaboration tools'],
'identity_theft_risk': 'High',
'operational_impact': ['Unauthorized consumption of paid '
'AI-service capacity',
'Account hijacking',
'Exposure of internal systems and trade '
'secrets'],
'systems_affected': ['AI-powered coding assistants (Claude, '
'Cursor, Codex, Cline, Continue, OpenCode, '
'Gemini, Kilo)']},
'lessons_learned': 'Attackers are exploiting the predictable local storage of '
'high-value credentials and configurations on compromised '
'endpoints. Organizations must treat AI-agent files as '
'part of their identity and access attack surface.',
'motivation': ['Data theft',
'Account hijacking',
'Reconnaissance for follow-on attacks',
'Extortion',
'Spear-phishing'],
'post_incident_analysis': {'corrective_actions': ['Inventory AI-agent '
'deployments',
'Secure credential storage',
'Rotate exposed tokens '
'post-breach',
'Enhance monitoring for '
'AI-agent account activity'],
'root_causes': ['Predictable local storage of '
'credentials',
'Dynamic collection rules enabling '
'malware to adapt to new AI tools',
'Lack of secure credential '
'management for AI agents']},
'recommendations': ['Inventory AI-agent deployments',
'Secure credential storage for AI tools',
'Rotate exposed tokens following a breach',
'Implement multi-factor authentication (though it may not '
'prevent abuse of stolen session tokens)',
'Monitor for unusual activity in AI-agent accounts'],
'references': [{'source': 'Gen Digital'}],
'response': {'remediation_measures': ['Inventorying AI-agent deployments',
'Securing credential storage',
'Rotating exposed tokens post-breach']},
'threat_actor': ['Amatera',
'Remus (Lumma Stealer variant)',
'CallbackBeaver',
'BeeStealer',
'STG Stealer',
'HydraStealer',
'APEX Stealer',
'Otter Stealer',
'Djinn Stealer'],
'title': 'Cybercriminals Expand Infostealer Malware to Target AI Coding '
'Assistants',
'type': 'Infostealer Malware',
'vulnerability_exploited': ['Predictable local storage of credentials',
'Lack of secure credential storage for AI agents',
'Active session token theft']}