Malware News Infostealers are adding AI-agent data to their target lists. GenD research found Remus, Amatera and CallbackBeaver collecting data associated with it.

[Khushal]

Content source

https://www.gendigital.com/blog/insights/research/infostealers-your-ai-agent

Our analysis of recent information-stealer collection rules found a much newer category alongside the familiar browser, wallet, and credential targets: local data associated with Claude, Cline, Codex, Continue, Cursor, OpenCode, and other AI-assisted development tools.

This was not an isolated experiment: over a three-month period, our Windows telemetry recorded Amatera and Remus detections among tens of thousands of protected users. Amatera targets data associated with Cline and Continue, while Remus targets Claude, Cursor, and OpenCode. The figures may overlap and describe detections rather than successful infections, but they show that AI agent data has already entered the information-stealer economy.

What the malware is collecting goes far beyond harmless preferences. Depending on the agent and its configuration, local files may contain access and refresh tokens, credentials stored in MCP configurations, prompt histories, conversation databases, account details, and traces of the projects a developer has been working on. In one archive, an attacker may obtain both the means to access an account and the context needed to understand what is valuable behind it.

Infostealers Have Found a New Target: Your AI Agent

Malware operators are expanding beyond browser passwords and crypto wallets to collect access tokens, MCP configurations, prompt histories and project data stored by AI tools.

www.gendigital.com

Our findings focus primarily on locally installed coding agents and agentic developer tools, and they do not point to a new way of compromising the device or to a vulnerability in an AI model or agent. The information stealer is already running; what has changed is the concentration of valuable information in predictable locations, sometimes in plaintext, and the ease with which those locations can be added to an existing collection list.

 

[Bot]

Hi Khushal, the important takeaway is that this is post-compromise collection, not a new AI-agent exploit. Once an infostealer is running, local coding-agent data can turn one infected developer workstation into access to accounts, source repositories, infrastructure and confidential project context.

Why this changes the impact​

Traditional stealers already search predictable locations for browser sessions, wallets and credentials. Adding AI development tools is a logical extension because their local files may combine two particularly useful things:

• Access material: tokens, API keys and credentials in agent or MCP configuration files.
• Operational context: prompts, conversations, workspace details and clues about valuable projects.

That context can help an attacker understand which stolen credentials matter. It also means that deleting prompt history is not a sufficient response after an infection; credentials and active sessions may already have been copied.

The reported telemetry should be read carefully: detections are not the same as confirmed successful theft, and overlapping figures must not be added as though they represent unique victims. The report nevertheless indicates that AI-agent locations have become explicit collection targets rather than merely hypothetical ones.

Practical defensive priorities​

For organizations and developers using these tools, the useful response is ordinary endpoint and secrets hygiene applied more deliberately:

1. Keep long-lived secrets out of agent configuration where possible. Prefer short-lived, narrowly scoped credentials and secret-management facilities over plaintext values.
2. Review MCP configurations and connected services. Give each integration only the permissions it needs; avoid broad personal tokens reused across projects.
3. Separate sensitive work where feasible. Distinct accounts, repositories and development environments limit what one stolen session can expose.
4. Treat an executed infostealer as credential compromise. From a separate trusted device, revoke relevant sessions and tokens, rotate exposed secrets, inspect connected applications, and review repository and cloud audit logs. A clean scan afterward does not make previously copied tokens secret again.
5. Include AI-tool locations in incident-response scoping. Responders should establish which agents were installed, which accounts they connected to and which projects were accessible during the suspected compromise.

There is no need to panic merely because one of these tools is installed. The decisive event remains malware execution; predictable local storage increases the payoff after that event.

One detail still unverified here​

The supplied text explains the targeting attributed to Amatera and Remus, but it does not specify CallbackBeaver’s collection rules or file paths, despite its appearance in the title. That attribution needs confirmation from the primary research before making specific claims about what CallbackBeaver collects.