{
  "slug": "agent-credential-stealers",
  "name": "Agent credential stealers",
  "aliases": [
    "Claude Fraud",
    "Vidar"
  ],
  "status": "active",
  "firstSeen": "2026-02-13",
  "lastSeen": "2026-09-01",
  "lastReviewed": "2026-09-20T00:00:00Z",
  "summary": "Infostealer branches increasingly target agent tokens, sessions, wallets, and MCP files.",
  "description": "The record joins Vidar's OpenClaw theft, Claude session theft, and the Claude Fraud fake extension and advertising wave.",
  "platforms": [
    "openvsx",
    "vscode-marketplace",
    "github",
    "other"
  ],
  "ttps": [
    {
      "framework": "atr",
      "id": "credential-theft"
    }
  ],
  "timeline": [
    {
      "date": "2026-02-13",
      "branch": "report",
      "id": "openclaw.json",
      "source": "https://www.bleepingcomputer.com/news/security/infostealer-malware-found-stealing-openclaw-secrets-for-first-time/"
    },
    {
      "date": "2026-03-17",
      "branch": "extension",
      "id": "claude-fraud",
      "note": "15,600 documented victims were reported.",
      "source": "https://blog.7ai.com/claude-fraud-malware-campaign-ai-developer-tools"
    },
    {
      "date": "2026-09-01",
      "branch": "report",
      "id": "claude-session-cookies",
      "source": "https://www.malwarebytes.com/blog/news/2026/09/infostealers-are-hijacking-claude-accounts-at-users-expense"
    }
  ],
  "iocs": [
    {
      "type": "repo",
      "value": "~/.openclaw/openclaw.json",
      "firstSeen": "2026-02-13",
      "source": "https://www.bleepingcomputer.com/news/security/infostealer-malware-found-stealing-openclaw-secrets-for-first-time/"
    },
    {
      "type": "extension",
      "value": "Claude Fraud",
      "firstSeen": "2026-03-17",
      "source": "https://blog.7ai.com/claude-fraud-malware-campaign-ai-developer-tools"
    }
  ],
  "exposedConfigurations": [
    {
      "label": "OpenClaw or a known fake agent extension is present",
      "matcher": {
        "any": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "openclaw"
          },
          {
            "some": "plugins",
            "where": {
              "field": "name",
              "op": "regex",
              "value": "claude|openclaw"
            }
          }
        ]
      }
    }
  ],
  "advisories": [
    "ACVE-2026-0415",
    "ACVE-2026-0416",
    "ACVE-2026-0417"
  ],
  "incidents": [],
  "sources": [
    {
      "url": "https://www.bleepingcomputer.com/news/security/infostealer-malware-found-stealing-openclaw-secrets-for-first-time/",
      "publisher": "BleepingComputer",
      "date": "2026-02-13"
    },
    {
      "url": "https://blog.7ai.com/claude-fraud-malware-campaign-ai-developer-tools",
      "publisher": "7AI",
      "date": "2026-03-17"
    },
    {
      "url": "https://www.malwarebytes.com/blog/news/2026/09/infostealers-are-hijacking-claude-accounts-at-users-expense",
      "publisher": "Malwarebytes",
      "date": "2026-09-01"
    }
  ],
  "dormantAfterDays": 30
}