Infostealers are actively hunting AI Agents and developer keys - Warden Infostealer analysis

Infostealers are actively targeting AI agents and developer keys, as evidenced by the Warden Infostealer. This infostealer successfully exfiltrates raw primaryApiKey values and detailed OAuth account data from Anthropic/Claude accounts, including compromised .claude.json files. By obtaining these CLI tokens, attackers bypass traditional web logins, gaining direct programmatic access to premium AI models, organizational workspaces, and potentially sensitive source code processed by these tools.