Infostealers Enable Resale of ChatGPT and Claude Access

Infostealers like WardenStealer and Aoki are seizing ChatGPT and Claude sessions, along with associated keys and tokens. Published on October 30, 2026, a study by SpyCloud describes access that remains valid despite a password change and is sold at low prices. The impacts go beyond the exposure of conversations and also affect connected technical resources.

Discounted AI Access: Up to 91% Off and 35% Commission

Illegal platforms are selling access to AI assistants and API credits at discounted rates of 40% to 91%. Some intermediaries pay the providers of stolen keys a commission that can reach 35% of the amounts charged through these accesses. Beyond the theft of conversations, these credentials allow the use of subscriptions and credits already paid for by other users. However, it is not established that all the access sold comes from the two studied malware; other sources like phishing and credential leaks also feed this market. In terms of volume, over 130,000 distinct infections related to WardenStealer have been recorded since August 3, 2026, a figure that does not equate to the number of compromised AI accounts, as the data thief collects multiple categories of information.

Why Sessions Survive Password Changes

ChatGPT and Claude maintain account access through cookies or authentication tokens. If an attacker gets hold of a still-valid token, they can, under certain conditions, reuse the session without knowing the new password and without going through multi-factor verification. This does not indicate a general failure of two-factor authentication but rather the reuse of an already granted authorization. A simple password change does not necessarily revoke all open sessions. Similarly, API keys and OAuth tokens remain exploitable until their expiration or revocation, with varying durations and permissions depending on the services.

Two Infostealers Behind It: WardenStealer and Aoki Also Target Assistants

Research conducted by SpyCloud focuses on WardenStealer and Aoki, two infostealers designed to siphon sensitive information from compromised machines. Historically associated with the theft of passwords, cookies, and cryptocurrency wallets, they are expanding their targets to AI assistants. Claude Code, Codex, Cursor, GitHub Copilot, as well as the desktop applications of ChatGPT and Claude, are among the services targeted. In the exfiltrated datasets, authentication and configuration files have been found. This type of theft can occur without compromising OpenAI or Anthropic servers, in a context where AI tools increasingly attract cybercriminals.

For Developers, MCP Tokens and Other Access May Be Exposed

Some programming assistants have permissions to code repositories, cloud services, or professional tools. Tokens linked to MCP servers have been found in Claude Code files, as well as authentication information from Codex. Armed with the right secrets, attackers can attempt to access other resources, within the limits of existing permissions, without this necessarily proving an automatic takeover of infrastructure. The centralization of connections and data in the browser increases the potential impact of session theft. Furthermore, researchers have shown that Claude Code and Codex can be trapped by a file placed in the Downloads folder, a distinct scenario but one that underscores the importance of access granted to agents. This type of abuse aligns with LLMjacking, described by researchers from Google Cloud, where compromised accounts can generate high expenses.

Regaining Control: Isolate, Revoke, Renew, and Monitor

Changing credentials from an infected machine can provide new data to thieves. First, isolate and examine the suspicious device, then clean it with appropriate tools. From a healthy workstation, revoke active sessions when the option exists, change the password, and renew API keys that may have been exposed. It is also recommended to check OAuth permissions, MCP connections, and applications linked to the accounts. Next, monitor activity logs, API usage, and any abnormal billing. If professional information is involved, the security team should conduct an audit of accessible services and any potential data leaks. Protecting an AI account involves managing sessions and permissions as much as it does securing the password.