Cloud-Credentials

Aokigahara Infostealer Targets Claude, Copilot, and Cursor Credentials

ATLAS OWASP HIGH ▲ 8.2 Check Point Research Oct 24, 2026

A newly identified infostealer dubbed Aokigahara has been observed actively harvesting authentication tokens and session data from AI development tools including Claude, ChatGPT Desktop, GitHub Copilot, Cursor, and Gemini CLI. Beyond traditional credential theft targeting browsers and crypto wallets, the malware includes dedicated collection routines for AI service credentials, SSH keys, and cloud environment configurations. Stolen AI session tokens could enable unauthorized access to paid AI services, exposure of private development data, or resale of compromised accounts on underground markets.

DPRK npm Supply Chain Worm Uses Web3 C2 to Steal Cloud Keys

ATLAS OWASP HIGH ▲ 6.5 Palo Alto Unit 42 Oct 08, 2026

North Korea-affiliated threat actors have escalated software supply chain attacks by embedding a self-propagating npm worm, ChainDrop, across over 400 packages to harvest ephemeral cloud IAM credentials and CI/CD tokens. The campaign introduces Web3-based command-and-control via EtherHiding smart contracts, enabling attackers to dynamically update exfiltration endpoints across entire botnets without altering malware binaries. Targeted projects include AI frameworks such as Mastra AI, raising direct concerns for AI development pipelines and their cloud infrastructure.

CVE-2026-64849: MLflow SSRF Exploited to Steal Cloud Credentials

ATLAS OWASP CRITICAL ▲ 8.5 The Hacker News Aug 19, 2026

A critical unauthenticated SSRF vulnerability in MLflow (CVE-2026-64849, CVSS 9.3) is being actively exploited within hours of CVE assignment, allowing attackers to proxy requests through exposed Tracking Servers to cloud metadata endpoints and exfiltrate credentials and secrets. Threat intelligence from watchTowr's honeypot telemetry confirms indiscriminate scanning of internet-facing MLflow instances targeting well-known internal IP ranges. Organisations running MLflow versions below 3.15.0 are at immediate risk and should treat this as a critical, time-sensitive patching priority.

Miasma Worm Compromises 73 Microsoft NPM Packages for AI Agents

ATLAS OWASP CRITICAL ▲ 8.5 Ars Technica Security Jun 09, 2026

Seventy-three Microsoft-hosted open source packages were compromised with the Miasma credential-stealing worm, which activates specifically when developers open packages inside AI coding agents. The malware, attributed to threat actor TeamPCP, exploits legitimate OIDC token workflows and SLSA provenance attestation to bypass supply-chain integrity checks and spread laterally across cloud infrastructure. This marks the second such compromise of an official Microsoft repository in as many months, indicating a sustained campaign targeting developer toolchains and the AI-assisted development pipeline.

node-ipc Supply Chain Backdoor Steals Cloud and AI Credentials

ATLAS OWASP CRITICAL ▲ 7.2 The Hacker News May 15, 2026

Three versions of the widely-used node-ipc npm package were found to contain obfuscated stealer/backdoor payloads published by an unauthorised maintainer account. The malware harvests 90 categories of developer secrets — including Claude AI and Kiro IDE configurations, AWS, Azure, and GCP credentials — and exfiltrates them via HTTPS and DNS tunnelling to an attacker-controlled domain. The compromise is notable for bypassing npm lifecycle hooks entirely and, in one version, targeting a specific developer via pre-computed SHA-256 fingerprinting.

PyTorch Lightning Package Backdoor Steals Developer Credentials

ATLAS OWASP HIGH ▲ 8.5 BleepingComputer May 05, 2026

A malicious version of PyTorch Lightning (v2.6.3) was published to PyPI, embedding a hidden execution chain that silently downloads a JavaScript runtime and executes a heavily obfuscated credential-stealing payload dubbed 'ShaiWorm'. The attack targeted AI/ML developers who use this popular deep learning framework, exposing cloud credentials, API keys, browser-stored secrets, and GitHub tokens. The package has since been reverted to a safe version, but any developer who imported the compromised version should rotate all secrets immediately.