Infostealers Target Cloud, Code, and AI Credentials to Enable Account Takeover
Summary
Wiz analyzes how infostealers harvest credentials, session tokens, and API keys from developer devices, potentially enabling access to cloud platforms, code repositories, and AI services.
Key points
- Wiz says Lumma C2, RedLine, and Vidar account for 85.7% of detected infostealer incidents in its analysis; it also found more than 400 types of non-credential secrets being harvested.
- AWS and GCP credentials made up 46% and 13% of compromised secrets, respectively; GitHub secrets accounted for roughly 10%, and AI-platform secrets for 5%.
- Infostealers target browser session cookies and tokens, which can let attackers reuse authenticated sessions and bypass MFA prompts.
- The article details targets including AWS and Azure CLI caches, GCP token databases and service-account keys, and GitHub and GitLab tokens, credentials, and runner configurations.
- AI-related targets include OpenAI session cookies and API keys, plus Claude Code tokens and configuration; the article notes that historical ChatGPT chat-log access is a potential risk but says it is not aware of public cases.
- The article also describes CI/CD supply-chain attacks that inject malicious code through compromised software dependencies to steal cloud credentials, CI tokens, and deployment artifacts.
Article Details
- Attack Vectors
- Infostealers delivered through social engineering and phishing links infect developers’ personal devices and steal credentials, API keys, browser cookies, and active session tokens.
- Stolen session cookies and tokens are replayed in an attacker-controlled browser to access cloud and developer accounts while bypassing MFA.
- Infostealers harvest credentials and tokens from local configuration files, browser caches, credential stores, environment variables, and cloud CLI authentication caches.
- Some malware injects code into browser processes or attaches a debugger to read session cookies from memory.
- A software dependency’s latest version can be hijacked to inject malicious code into CI/CD pipelines, development servers, and build processes.
- Stolen credentials and access tokens can be used to access cloud environments, code repositories, CI/CD secrets, deployment pipelines, and AI services.
- Defensive Notes
- Wiz scans cloud environments, code repositories, and developer workstations for malware and exposed secrets, and can alert organizations when their secrets appear on the dark web.
- The article identifies use of an operating-system keychain, including through Granted, as a more secure alternative to storing temporary AWS tokens in plaintext credential files.
MITRE ATT&CK
T1005 · Data from Local SystemInfostealers collect credentials, tokens, and other targeted artifacts from files and caches on infected devices.T1055 · Process InjectionThe article describes injecting code into a browser process to retrieve session cookies from memory.T1078 · Valid AccountsStolen cloud credentials and tokens are used to access victims’ cloud environments and accounts as legitimate users.T1195.002 · Compromise Software Supply ChainMiasma-like CI/CD infostealers target a software dependency and hijack its latest version to inject malicious code into victim environments.T1539 · Steal Web Session CookieInfostealers extract active session cookies, including cookies for AWS, GitHub, GitLab, and ChatGPT.T1550.004 · Web Session CookieAttackers use stolen session cookies in their own browsers to assume victims’ authenticated sessions and bypass MFA.T1552.001 · Credentials In FilesInfostealers harvest credentials and tokens from local files such as cloud CLI configuration files, .env files, and developer credential files.T1566.002 · Spearphishing LinkThe article describes phishing links as a route to infostealer infection on employees’ personal devices.
CVE
Threat Actors
Malware
Amadeyin self-hosted GitLab instances (such as CVE-2023-7028) to distribute infostealers like StealC via the Amadey loader. Once deployed, these stealers harvest browser credentials and cookies, which frequently includeGhost LoaderSSH keys also remain a persistent target. Infostealers like Ghost Loader specifically extract ~/.ssh/id_rsa to gain long-term GitHub access. For session hijacking, attackers target browser cookies includingLummathreat actors. It begins with Malware-as-a-Service (MaaS) platforms, where potent infostealers like Lumma and RedLine are rented for as little as a few hundred dollars a month. These tools are designed for oneLummaC2reveals a concentrated threat landscape dominated by a small number of prolific infostealer families: Lumma C2, RedLine, and Vidar, account for 85.7% of all detected incidents, underscoring the commoditization ofMiasmaMore recently infostealer-like malware such as Miasma has targeted CI/CD pipelines, development servers and build processes. In these cases, phishing isn’t an applicable initial access vector; instead, attackers targetRedLineactors. It begins with Malware-as-a-Service (MaaS) platforms, where potent infostealers like Lumma and RedLine are rented for as little as a few hundred dollars a month. These tools are designed for one purpose:StealCvulnerabilities in self-hosted GitLab instances (such as CVE-2023-7028) to distribute infostealers like StealC via the Amadey loader. Once deployed, these stealers harvest browser credentials and cookies, whichVidarthreat landscape dominated by a small number of prolific infostealer families: Lumma C2, RedLine, and Vidar, account for 85.7% of all detected incidents, underscoring the commoditization of the infostealer
Vendors
AnthropicAnthropic Claude CodeGoogleGoogle Cloud Platform (GCP)MicrosoftStolen credentials are widely recognized as one of the most common initial infection vectors - Microsoft, Recorded Future, and Verizon’s DBIR all point to infostealers as a cause of major concern. These attacks beginNordStellarOur analysis of secrets detected on infected machines through Wiz's integration with NordStellar reveals a concentrated threat landscape dominated by a small number of prolific infostealer families: Lumma C2, RedLine,OpenAItotal. AI platforms are also a significant piece, comprising 5% of stolen secrets, led predominantly by OpenAI API keys. These AI credentials are highly lucrative; allowing attackers to freely run their own workloadsWizOur analysis of secrets detected on infected machines through Wiz's integration with NordStellar reveals a concentrated threat landscape dominated by a small number of prolific infostealer families: Lumma C2, RedLine,
Products
AWSa simple malware infection on a personal device, and end with attackers gaining privileged access to your AWS, Azure, or GCP estate, and more recently to the code platforms used by your organization, such as GitHub orAzuremalware infection on a personal device, and end with attackers gaining privileged access to your AWS, Azure, or GCP estate, and more recently to the code platforms used by your organization, such as GitHub orChatGPTOpenAI API and ChatGPTClaude CodeAnthropic Claude CodeCodexAs AI-powered coding assistants such as Claude Code and Codex become integral to developer workflows, they have emerged as a new target category for credential theft. These tools store authentication tokens andGCPinfection on a personal device, and end with attackers gaining privileged access to your AWS, Azure, or GCP estate, and more recently to the code platforms used by your organization, such as GitHub or GitLab.GitHubAWS, Azure, or GCP estate, and more recently to the code platforms used by your organization, such as GitHub or GitLab.GitLabor GCP estate, and more recently to the code platforms used by your organization, such as GitHub or GitLab.
Tools
gimme-aws-credsSSO tokens are not written here; however, many third-party tools that developers use (such as gimme-aws-creds) might inject temporary tokens into this file for compatibility with older SDKs. A more secureLinPEASThe popular privilege escalation auditing suite PEASS-ng (linPEAS/winPEAS) now includes detection rules for AI coding assistant credentials. Its sensitive_files.yaml configuration explicitly searches the ~/.claude/PEASS-ngThe popular privilege escalation auditing suite PEASS-ng (linPEAS/winPEAS) now includes detection rules for AI coding assistant credentials. Its sensitive_files.yaml configuration explicitly searches the ~/.claude/winPEASThe popular privilege escalation auditing suite PEASS-ng (linPEAS/winPEAS) now includes detection rules for AI coding assistant credentials. Its sensitive_files.yaml configuration explicitly searches the ~/.claude/