{
  "entry": {
    "kind": "vuln",
    "slug": "gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest",
    "name": "gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest",
    "vendor": "Not",
    "description": "Gen Digital threat research team lead Jan Rubín reported on 8 September 2026 that infostealer families have added AI coding agents to their collection targets. CallbackBeaver added Cursor and Claude, with more than 5,000 samples observed in a recent 30-day period; Amatera targets Cline and Continue; Remus targets Claude, Cursor and OpenCode; and the macOS stealer Djinn is associated with Claude, Codex, Gemini, Cline, OpenCode and Kilo. Lower-prevalence families (BeeStealer, STG, HydraStealer, APEX, Otter) show the behaviour spreading. What is taken: access and refresh tokens, MCP configuration credentials (endpoints, headers, environment variables, API keys), prompt histories and conversation databases, and account, organization and billing details. Gen says AI-agent data has appeared in another stealer's collection rules almost every day. Over three months its Windows telemetry recorded Amatera and Remus detections among tens of thousands of protected users (detections, not confirmed infections). The post gives no exact file paths, since they vary by product, OS and settings, and stresses that resetting browser passwords alone does not clean up after an infection.",
    "website": "https://www.gendigital.com/blog/insights/research/infostealers-your-ai-agent",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-09-08",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest",
      "aliases": [
        "ti-119"
      ],
      "title": "Gen Digital: Infostealers (CallbackBeaver, Amatera, Remus, Djinn) Now Harvest AI Coding-Agent Tokens, MCP Configs and Prompt Histories",
      "summary": "Gen Digital threat research team lead Jan Rubín reported on 8 September 2026 that infostealer families have added AI coding agents to their collection targets. CallbackBeaver added Cursor and Claude, with more than 5,000 samples observed in a recent 30-day period; Amatera targets Cline and Continue; Remus targets Claude, Cursor and OpenCode; and the macOS stealer Djinn is associated with Claude, Codex, Gemini, Cline, OpenCode and Kilo. Lower-prevalence families (BeeStealer, STG, HydraStealer, APEX, Otter) show the behaviour spreading. What is taken: access and refresh tokens, MCP configuration credentials (endpoints, headers, environment variables, API keys), prompt histories and conversation databases, and account, organization and billing details. Gen says AI-agent data has appeared in another stealer's collection rules almost every day. Over three months its Windows telemetry recorded Amatera and Remus detections among tens of thousands of protected users (detections, not confirmed infections). The post gives no exact file paths, since they vary by product, OS and settings, and stresses that resetting browser passwords alone does not clean up after an infection.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft",
        "Malware"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Not",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Not version-specific; targets locally stored agent tokens, MCP configs and history files.",
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-09-08",
      "modifiedAt": "2026-09-08",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.gendigital.com/blog/insights/research/infostealers-your-ai-agent"
        }
      ],
      "mitigation": "Inventory which AI agents run on endpoints and where each stores tokens, history and MCP credentials, and prefer OS keychains over plaintext token files. Use short-lived, scoped tokens for MCP servers, keep personal and production access separate, and revoke unused connections. Keep secrets out of prompts, and delete or rotate any that appear in local histories. After an infostealer infection, revoke AI-service sessions, rotate MCP-related API keys, review connected apps and check whether local prompt histories exposed company data, in addition to resetting browser passwords. Harden endpoints against the usual delivery routes: ClickFix/FakeCaptcha lures, cracked software and unofficial installers.",
      "detectedByAnomity": true
    }
  }
}