Cybercriminals Expand Infostealer Malware to Target AI Coding Assistants Cybercriminals are increasingly adapting information-stealing malware to harvest sensitive data from AI-powered coding assistants, including Claude, Cursor, Codex, Cline, Continue, and OpenCode. This shift places developer credentials, Model Context Protocol (MCP) configurations, prompt histories, project metadata, and proprietary source code at risk assets now funneled into the same theft pipelines long used for browser cookies, cryptocurrency wallets, and password stores. ### Key Threats and Attack Vectors On Windows, malware families like Amatera (targeting Cline and Continue) and Remus (focusing on Claude, Cursor, and OpenCode) have been detected among tens of thousands of users over a three-month period. While these figures reflect detections rather than confirmed infections, they highlight the growing trend. CallbackBeaver has also expanded its scope to include Claude and Cursor, with researchers observing over 5,000 samples in a 30-day period. Other infostealers BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer demonstrate that AI-agent targeting is spreading across the malware ecosystem. On macOS, Djinn Stealer has been linked to the collection of local data from Claude, Codex, Gemini, Cline, OpenCode, and Kilo. ### Why AI-Agent Data Is Valuable to Attackers Stolen AI-agent data provides attackers with access tokens, refresh tokens, account identifiers, subscription details, conversation histories, and project configurations. A compromised access token could allow attackers to consume paid AI-service capacity or hijack accounts, while refresh tokens may extend unauthorized access. More critically, MCP configurations which enable AI agents to connect with external tools and enterprise systems may expose API keys, endpoints, authorization headers, and credentials for source-control platforms, cloud services, databases, and collaboration tools. Prompt histories pose another risk, as developers frequently use coding assistants to analyze logs, review code, troubleshoot incidents, and summarize internal documentation. These records may inadvertently reveal internal hostnames, repository structures, security controls, customer data, or trade secrets, serving as pre-collected reconnaissance for follow-on attacks like spear-phishing, extortion, or account takeovers. ### How Attackers Are Scaling the Threat Many infostealers operate with dynamic collection rules, allowing operators to update target directories, filenames, and file extensions without redistributing malware. Once a new AI tool gains popularity, existing infections can begin harvesting its data after a simple configuration change. This flexibility has contributed to a broader surge in infostealer activity Gen Digital recorded over 3.3 million unique detections in the first half of 2026, with monthly totals exceeding 500,000. Remus, a Lumma Stealer variant, exemplifies the technical sophistication behind these attacks. It employs string obfuscation, anti-VM checks, syscall handling, and indirect control-flow obfuscation, along with an Application-Bound Encryption bypass. Its command-and-control infrastructure relies on Ethereum smart contracts for EtherHiding-based resolution, making it more resilient than traditional dead-drop mechanisms. ### Broader Implications The expansion of infostealer malware into AI-agent data underscores a critical shift: attackers are exploiting the predictable local storage of high-value credentials and configurations on already-compromised endpoints. Organizations must now treat AI-agent files as part of their identity and access attack surface, requiring inventorying deployments, securing credential storage, and rotating exposed tokens following a breach. While multi-factor authentication remains essential, it may not prevent abuse if an attacker has already stolen an active session token.