What happens if an infostealer does not just steal your employee's password, but steals the credentials your AI tools use to access other systems?
That is the concern raised by new research into the Remus infostealer.
SpyCloud researchers found that newer versions of Remus are specifically targeting credential folders associated with OpenAI, Anthropic, and other AI platforms, along with browser sessions, passwords, cryptocurrency wallets, cloud credentials, password managers, and two-factor authentication extensions. Read the SpyCloud research.
For businesses adopting AI coding tools and AI agents, the potential impact goes well beyond an unexpected ChatGPT bill.
Key Takeaway: AI API keys, tokens, and agent credentials are becoming valuable attack targets because they can provide authenticated access without requiring an attacker to steal a password or defeat MFA. Businesses need to protect both the credentials themselves and the Windows endpoints where those credentials are stored and used.
Remus is a Windows infostealer that first appeared on underground marketplaces around March 2026 and has continued to evolve.
According to SpyCloud Labs, the malware currently targets data from 21 browsers and 16 cryptocurrency wallets. Newer builds also seek credentials associated with Claude Code, OpenAI tools, Cursor, Codex, OpenCode, Azure, Google Cloud, Bitwarden, 1Password, KeePass, VPN applications, and other software. See the technical findings.
Remus can also collect locally stored AI usage information.
That matters because AI environments can contain prompts, source code, internal URLs, project details, cloud information, development credentials, and other sensitive business context.
This is no longer simply a malware problem involving stolen passwords.
It is becoming an identity and trusted-access problem.
Because an API token can effectively function as a machine identity.
Unlike an employee logging into an application, an API key usually does not stop and ask for an MFA code. Software presents the credential automatically and receives whatever access that credential has been granted.
Anthropic recently warned that stolen API keys and session tokens are increasingly becoming an objective of criminal groups. The company says stolen AI credentials are being resold through brokers and used to run malicious workloads at someone else's expense. Read Anthropic's threat intelligence report.
Anthropic describes three benefits criminals can obtain from compromised AI credentials: resale value, computing resources paid for by the victim, and activity that appears to originate from the legitimate credential owner.
That changes the risk equation considerably.
An attacker might steal an AI credential today and use it later as part of an entirely different attack.
The numbers suggest this is much larger than one malware family.
SpyCloud reported recovering 18.1 million exposed API keys and tokens during 2025, including credentials associated with cloud infrastructure, developer platforms, payment services, collaboration applications, and AI tools. It also recovered 6.2 million authentication cookies or credentials associated with AI tools. See SpyCloud's 2026 Identity Exposure Report.
Its 2026 research also found an important visibility gap.
While 95% of surveyed organizations believed they had visibility into non-human identity exposures, only 36% were actively monitoring them. Read the findings.
This matters as businesses give AI tools increasingly broad access to source code, documents, cloud environments, development systems, APIs, and internal applications.
The AI may be secure.
The credential controlling it may not be.
Potentially, and Detect and Respond remains an important security layer. But Remus is specifically designed to make that job harder.
SpyCloud found that Remus performs a sweep for Windows syscall hooks and removes hooks that security products may use to observe suspicious system activity. It then uses direct system calls and common Windows COM objects for some of its operations. Review the SpyCloud analysis.
SpyCloud's broader 2026 research also reported that 40% of malware infections in its dataset occurred on endpoints where EDR or antivirus software was installed. That does not mean those products provide no value. It demonstrates why businesses should not assume detection alone guarantees that credential theft will be stopped before information leaves the device. View the report.
Remus makes this particularly important because it exfiltrates stolen information in stages. If the malware is interrupted halfway through its operation, credentials stolen earlier in the process may already be gone.
This is where prevention deserves more attention.
Remus may evolve. Another infostealer may use different code tomorrow. AI may eventually help attackers generate malware that looks different on every execution.
But changing the attack does not necessarily change the endpoint actions the attacker ultimately needs in order to succeed.
The malware still needs to execute. It needs to interact with applications, memory, files, credential stores, system resources, and eventually communicate stolen information outside the endpoint.
Unknown does not automatically mean unstoppable.
Isolation and Containment approaches reduce the freedom software has to perform those actions, even when the specific malware has not previously been identified.
The objective is not to predict every attack. It is to restrict the actions an attacker needs in order to succeed.
AppGuard is one example of this approach. AppGuard is a proven endpoint protection solution with more than a decade of production history focused on prevention through Isolation and Containment.
It does not need to know the name of every attack to restrict unauthorized endpoint behavior. This complements rather than replaces EDR, identity security, MFA, credential management, and other Detect and Respond technologies.
Treat AI credentials as production credentials, not simply configuration information.
Organizations should also remember that changing a password after an infostealer infection may not be enough.
API tokens, session cookies, cloud credentials, authentication artifacts, and AI identities may need to be revoked independently.
Cybercriminals follow access.
First they aggressively targeted passwords. Then browser cookies and authenticated sessions became highly valuable.
Now AI credentials and machine identities are joining the list.
Remus is one example of that transition, but it will almost certainly not be the last.
As businesses connect AI to more sensitive systems, defending the AI application itself is only part of the challenge. Businesses also have to protect the Windows endpoints where employees, developers, and AI tools interact.
The attack may be new.
The actions it needs to perform on a Windows endpoint often are not.
For additional context on how Remus has evolved from password theft toward authenticated access, see our earlier analysis, Remus Infostealer Shows Why Stolen Sessions Are So Dangerous.