cyber.hendryadrian.com
Threat Research · gendigital.com

Infostealers Add AI Coding Agents to Their Collection Targets

· Original article ↗

Summary

Gen Digital reports that multiple infostealer families now target local data from AI coding agents, potentially exposing tokens, connected-service credentials, and conversation history. The company recommends protecting credentials, limiting access, and including agent,

Key points

  • Gen Digital found AI-agent data in collection rules for multiple infostealers, including Amatera, Remus, CallbackBeaver, and Djinn Stealer.
  • Targets include local data associated with tools such as Claude, Cursor, Cline, Continue, Codex, and OpenCode.
  • Files may contain access or refresh tokens, MCP credentials, conversation histories, project details, and account information.
  • Stolen credentials and histories could enable account abuse, expose connected services or sensitive work, and provide attackers with reconnaissance; outcomes depend on the credentials and service controls.
  • Collection rules can be updated remotely, so operators may add agent files to existing malware installations without rebuilding or redistributing the malware.
  • Gen Digital recorded infostealer detections among tens of thousands of protected users over three months for Amatera and Remus; detections do not establish successful infections.
  • The article recommends OS-protected credential storage, limiting MCP permissions, keeping secrets out of prompts, and revoking sessions and rotating exposed credentials after a suspected infection.

Article Details

Attack Vectors
  • Information stealers collect locally stored AI-agent access and refresh tokens, credentials in MCP configurations, prompt histories, conversation databases, account details, and project records.
  • Collection rules can be remotely updated to add agent directories and files on devices already compromised by a stealer.
  • The article identifies ClickFix/FakeCaptcha instructions, cracked software, and unofficial installers as common routes used to deliver information stealers.
Defensive Notes
  • Inventory locally installed agents and review their credential, conversation, project-record, MCP-configuration, and retention settings.
  • Prefer OS-protected credential storage over file-based token storage, and treat local authentication files containing tokens like password stores.
  • Avoid putting secrets or customer data in prompts; rotate exposed secrets and remove retained conversations where possible.
  • Restrict MCP integrations to necessary permissions, use short-lived and narrowly scoped tokens, separate personal, development, and production access, and revoke unused connections.
  • Keep operating systems and applications updated, use reputable endpoint protection, and be cautious with ClickFix/FakeCaptcha instructions, cracked software, and unofficial installers.
  • After suspected infection, use a clean device to revoke AI-service sessions, rotate API keys and MCP-related credentials, review connected applications and account activity, and assess exposure of company information in prompts or transcripts.
  • Agent developers should minimize retained sensitive data, separate authentication material from history, use OS-protected credential storage, provide clear retention controls, and make tokens scoped, short-lived, and revocable.

Malware

AmateraThis was not an isolated experiment: over a three-month period, our Windows telemetry recorded Amatera and Remus detections among tens of thousands of protected users. Amatera targets data associated with Cline andAPEX Stealera recent 30-day period. Lower-prevalence families, including BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer, show that the behavior is spreading beyond one or two larger operations The paceBeeStealerwe observed more than 5,000 samples during a recent 30-day period. Lower-prevalence families, including BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer, show that the behavior is spreading beyondCallbackBeaverCallbackBeaver, a fast-emerging stealer, has added Cursor and Claude to its collection scope, and we observed more than 5,000 samples during a recent 30-day period. Lower-prevalence families, including BeeStealer, STGDjinn StealerThe same behavior is visible across operating systems, with Djinn Stealer on macOS associated with collecting data from Claude, Codex, Gemini, Cline, OpenCode, and Kilo. HydraStealersamples during a recent 30-day period. Lower-prevalence families, including BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer, show that the behavior is spreading beyond one or two largerOtter Stealerperiod. Lower-prevalence families, including BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer, show that the behavior is spreading beyond one or two larger operations The pace of adoption isRemusThis was not an isolated experiment: over a three-month period, our Windows telemetry recorded Amatera and Remus detections among tens of thousands of protected users. Amatera targets data associated with Cline andSTG Stealerthan 5,000 samples during a recent 30-day period. Lower-prevalence families, including BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer, show that the behavior is spreading beyond one or two

Products

Claudenewer category alongside the familiar browser, wallet, and credential targets: local data associated with Claude, Cline, Codex, Continue, Cursor, OpenCode, and other AI-assisted development tools. Clinealongside the familiar browser, wallet, and credential targets: local data associated with Claude, Cline, Codex, Continue, Cursor, OpenCode, and other AI-assisted development tools. Codexalongside the familiar browser, wallet, and credential targets: local data associated with Claude, Cline, Codex, Continue, Cursor, OpenCode, and other AI-assisted development tools. Continuethe familiar browser, wallet, and credential targets: local data associated with Claude, Cline, Codex, Continue, Cursor, OpenCode, and other AI-assisted development tools. Cursorbrowser, wallet, and credential targets: local data associated with Claude, Cline, Codex, Continue, Cursor, OpenCode, and other AI-assisted development tools. GeminiThe same behavior is visible across operating systems, with Djinn Stealer on macOS associated with collecting data from Claude, Codex, Gemini, Cline, OpenCode, and Kilo. KiloThe same behavior is visible across operating systems, with Djinn Stealer on macOS associated with collecting data from Claude, Codex, Gemini, Cline, OpenCode, and Kilo. Model Context ProtocolThe Model Context Protocol, commonly known as MCP, can extend that access beyond the AI service. It allows an agent to connect to external tools and data sources, and local configurations may include endpoints, headers,OpenCodewallet, and credential targets: local data associated with Claude, Cline, Codex, Continue, Cursor, OpenCode, and other AI-assisted development tools. 

Related Articles