Kiran 
Information-stealing malware has quietly expanded its shopping list. Beyond browser passwords and crypto wallets, stealers now harvest access tokens, MCP configurations, prompt histories, and project data from AI coding assistants like Claude, Cursor, Cline, Codex, and OpenCode, turning developer workspaces into a new goldmine for cybercriminals.
Threat intelligence from Gen Digital’s research team found that stealer families such as Amatera and Remus have added AI-agent directories to their collection rules, with tens of thousands of Windows detections logged over three months.
Amatera targets Cline and Continue; Remus goes after Claude, Cursor, and OpenCode. On macOS, Djinn Stealer pulls data from Claude, Codex, Gemini, Cline, OpenCode, and Kilo, proving this isn’t a platform-specific quirk but a cross-OS trend.
Infostealers Now Target AI Agents
CallbackBeaver, a rapidly growing stealer family, logged more than 5,000 samples targeting Cursor and Claude in just 30 days. Smaller operations BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer are following suit, with new AI-targeting rules appearing “almost every day.”
What makes this shift dangerous isn’t a new exploit; it’s concentration. Local AI-agent files can contain access and refresh tokens, MCP-stored credentials (API keys, endpoints, headers), full conversation histories, and metadata like account IDs, billing tier, and recent project activity.
A single stolen archive can hand attackers both the keys to an account and the context to know exactly what that account is worth: proprietary code, internal hostnames, or unfinished trade secrets pasted into a chat window.
“We’ve spent a decade training developers to treat their password managers like vaults, but their AI assistants have quietly become an equally sensitive vault with none of the same instincts attached that gap is exactly what threat actors are now racing to exploit.”
Because many stealers already pull collection rules from remote configuration files, adding a new AI tool to the target list can be as simple as appending a file path; no rebuild or redistribution required.
Once an operator identifies where an agent stores its data, existing infections can be remotely updated to start harvesting it immediately.
Security teams should fold AI-agent data into existing identity and access management practices rather than treating it as a novelty. Recommended steps include:
- Inventory which AI agents are installed and where they store credentials, MCP configs, and history.
- Use OS-level credential stores (Keychain, Credential Manager) instead of plaintext token files.
- Avoid pasting secrets, API keys, or customer data into prompts; rotate anything accidentally exposed.
- Scope MCP integrations tightly, favor short-lived tokens, and revoke unused connections.
- After any suspected stealer infection, rotate AI-service sessions and MCP-linked API keys, not just browser passwords.
Ultimately, vendors building these agents need to bake in safer defaults: short-lived, narrowly scoped tokens, OS-protected storage, and clear visibility into MCP connections. Encryption at rest means little if the decryption key sits beside the database.
As AI agents evolve into a working memory of who developers are and what they build, attackers have already recognized that value the industry’s defenses need to catch up just as fast.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
