Infostealers Target Claude AI Sessions, Fire Ant Hits Hypervisors, ValleyRAT Poses as Adware: Defender's Guide to Round 113 Malware Campaigns

The latest Security Affairs malware roundup (Round 113) reads like a snapshot of where attacker tradecraft is heading in 2026 — and none of it is good news for defenders. Four stories stand out, and each maps to a distinct defensive gap I see repeatedly in client environments:

1. Infostealers are now harvesting Claude (Anthropic) login sessions. This is the natural evolution of a trend we've tracked since infostealers moved beyond banking credentials to SaaS tokens. AI platform sessions are high-value: they carry conversation history (often containing source code, credentials pasted into prompts, and internal business data), API access, and in enterprise deployments, a foothold into corporate workflows.
2. Fire Ant is evolving from hypervisor compromise to trusted infrastructure. The campaign continues the pattern of Chinese-nexus actors living inside the virtualization and network edge layer — below the OS, above the reach of most EDR.
3. Gryxa, an AI-built malware toolkit, actively observes and responds to removal attempts. Anti-analysis and anti-remediation logic — once the hallmark of elite actors — is being democratized by AI-assisted malware development.
4. ValleyRAT is masquerading as adware. A trojan that presents as a nuisance to lower analyst guard while establishing full remote access.

Individually these are four stories. Collectively they describe one problem: attackers are targeting the trust layers your SOC monitors least — SaaS session tokens, hypervisors, and the analyst's own assumptions about severity. This post gives you the detection and hardening content to close those gaps.

Technical Analysis

1. Infostealers Harvesting Claude/AI Platform Sessions

How the attack works: Modern infostealers (the same family class as Lumma, RedLine, StealC, and Vidar variants) enumerate browser profile directories and extract session cookies, tokens, and stored credentials. What changed in this campaign is the target list: stealer configs now explicitly include claude.ai session cookies and, where present, locally stored API tokens from developer tooling.

Attack chain from the defender's seat:

• Delivery via malvertising, cracked software, SEO-poisoned "AI tools," or fake browser updates.
• Stealer executable runs in user context (no admin needed — browser session stores are user-readable by design).
• Reads Cookies / Network\Cookies SQLite databases and the Local State file (which holds the DPAPI-encrypted master key) from Chrome, Edge, Brave, and Firefox profiles.
• Filters harvested cookies for claude.ai (and typically chatgpt.com, google.com, Microsoft Entra ID, Okta, and GitHub domains).
• Exfiltrates to C2 over HTTPS, often through legitimate CDN or Telegram channels.
• Session cookies are replayed from attacker infrastructure — bypassing passwords and, critically, often bypassing MFA, because the token is already post-authentication.

Why session theft beats password theft: A stolen Claude session cookie lets the attacker resume an authenticated session without triggering a login event, MFA prompt, or impossible-travel alert in many configurations. Anthropic and other providers flag anomalous session reuse, but enforcement is inconsistent. Treat an active session token as a credential — because to the attacker, it is one.

Exploitation status: Confirmed in-the-wild distribution. Infostealer-as-a-service ecosystems make this commoditized, not targeted.

2. Fire Ant: From Hypervisors to Trusted Infrastructure

Fire Ant continues the tradecraft lineage of actors who compromise VMware ESXi hosts and network edge appliances, then pivot into workloads from beneath the visibility plane. The reported evolution — moving from hypervisors into "trusted infrastructure" — means the actor is abusing the implicit trust placed in management interfaces, backup systems, and internal service accounts.

Defender's implications:

• Your Windows EDR does not see ESXi. Your ESXi host has minimal native logging forwarded to the SIEM in most environments I've assessed.
• Compromised hypervisors enable "invisible" VM tampering: snapshot manipulation, offline disk mounting, and credential extraction from VM memory — none of which generate endpoint telemetry inside the guest.
• Detection must shift to: hypervisor shell activity (esxcli, vim-cmd, unexpected SSH enablement), new local accounts on ESXi, unapproved vSphere API calls, and network flows from hypervisor management interfaces to destinations that aren't your vCenter or backup infrastructure.

3. Gryxa: AI-Built Anti-Remediation Logic

Gryxa is notable not for its payload but for its persistence philosophy: it monitors for removal activity — security tool execution, service stops, quarantine events — and responds (re-infection, component respawn, or evasive dormancy). This mirrors what we've long seen in mature families (e.g., certain Emotet and Qakbot modules watching for analyst tooling), now packaged into AI-generated toolkits available to lower-skilled operators.

Defensive consequence: Partial remediation is now an active risk. If you kill one component while the watcher survives, expect re-infection within minutes to hours. IR playbooks must assume the malware is observing the response and plan for coordinated, near-simultaneous removal of all components — or full host isolation before any triage action.

4. ValleyRAT Masquerading as Adware

ValleyRAT (associated with Chinese-language threat clusters and frequently delivered alongside the Silver Fox ecosystem) is being distributed under the guise of adware or bundled "free" software. This is a psychological operation against your SOC: adware alerts are the most commonly deprioritized, auto-closed, or suppression-ruled alerts in any queue.

Attack chain:

• Installer presented as ad-supported freeware; initial behavior genuinely displays ads or browser modifications (the camouflage layer).
• Background stage deploys the RAT: persistence via Run key or scheduled task, often with a renamed system-sounding binary in %APPDATA% or %ProgramData%.
• C2 over TCP/HTTPS with full capability: shell execution, file transfer, keylogging, screen capture, and plugin loading.
• Because the initial classification is "PUP/adware," the alert severity — and the response — is wrong by design.

The rule I give every SOC I assess: any "adware/PUP" detection on a system that later touches sensitive data, or any PUP alert that coincides with new persistence or new outbound connections, gets re-queued as a malware investigation. The adware label is a hypothesis, not a conclusion.

Detection & Response

Sigma Rules

The following rules target the highest-signal, lowest-noise behaviors from these campaigns: unauthorized access to browser session stores (infostealer/Claude session theft), masqueraded persistence from user-writable directories (ValleyRAT), and security-tool-aware anti-remediation behavior (Gryxa-class toolkits).

---
title: Non-Browser Process Accessing Browser Cookie or Session Stores
description: Detects processes other than the browser itself reading browser cookie databases or Local State files — a hallmark of infostealers harvesting SaaS session tokens (e.g., claude.ai, ChatGPT, Entra ID). Expect baseline tuning in environments with legitimate backup or DLP agents.
references:
  - https://attack.mitre.org/techniques/T1539/
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/02/20
status: experimental
tags:
  - attack.credential_access
  - attack.t1539
  - attack.t1555.003
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Local\BraveSoftware\Brave-Browser\User Data\'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
  selection_files:
    TargetFilename|endswith:
      - '\Network\Cookies'
      - '\Cookies'
      - '\Local State'
      - '\cookies.sqlite'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: selection_paths and selection_files and not filter_browsers
falsepositives:
  - Enterprise backup or DLP agents reading user profiles
  - Legitimate password managers with browser import features
level: high
---
title: Persistence From User-Writable Directory Masquerading as System Binary
description: Detects Run key or scheduled-task persistence pointing to binaries in AppData/ProgramData/Temp using system-sounding names — consistent with ValleyRAT-class implants disguised as adware or freeware components.
references:
  - https://attack.mitre.org/techniques/T1547/001/
  - https://attack.mitre.org/techniques/T1036/005/
author: Security Arsenal
date: 2026/02/20
status: experimental
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1036.005
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_value:
    Details|contains:
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
  condition: selection_key and selection_value
falsepositives:
  - Legitimate per-user applications (Slack, Teams, OneDrive) registering autostart — baseline and whitelist per environment
level: medium
---
title: Process Terminating or Disabling Security Tools
description: Detects command-line attempts to kill, stop, or disable EDR/AV processes and services — consistent with anti-remediation toolkits (Gryxa-class) that watch for and counter removal activity.
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/02/20
status: experimental
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'taskkill'
      - 'net stop'
      - 'sc stop'
      - 'sc config'
      - 'Stop-Service'
      - 'Set-MpPreference'
  selection_target:
    CommandLine|contains:
      - 'MsMpEng'
      - 'Sense'
      - 'windefend'
      - 'SentinelAgent'
      - 'CarbonBlack'
      - 'csfalcon'
      - 'cyserver'
      - 'Sophos'
      - 'DisableRealtimeMonitoring'
  condition: selection_cmd and selection_target
falsepositives:
  - Authorized AV administration and software deployment tooling
level: high

KQL — Microsoft Sentinel / Defender

This hunt correlates non-browser processes touching browser session stores with subsequent outbound network activity — the infostealer exfiltration pattern. Run it across a 14-day window; any hit warrants immediate session revocation for the affected user's SaaS accounts, including AI platforms.

let lookback = 14d;
let browserPaths = dynamic([@"\Google\Chrome\User Data\", @"\Microsoft\Edge\User Data\", @"\BraveSoftware\", @"\Mozilla\Firefox\Profiles\"]);
let sessionFiles = dynamic([@"Cookies", @"Local State", @"cookies.sqlite", @"Login Data"]);
let browsers = dynamic([@"chrome.exe", @"msedge.exe", @"brave.exe", @"firefox.exe"]);
let suspiciousReads = DeviceFileEvents
| where Timestamp > ago(lookback)
| where FileName has_any (sessionFiles)
| where FolderPath has_any (browserPaths)
| where not(InitiatingProcessFileName has_any (browsers))
| project ReadTime=Timestamp, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, FolderPath, AccountName;
suspiciousReads
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | project ConnectTime=Timestamp, DeviceId, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
) on DeviceId, InitiatingProcessFileName
| where ConnectTime between (ReadTime .. ReadTime + 10m)
| project ReadTime, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, RemoteUrl, RemoteIP, RemotePort
| order by ReadTime desc

Velociraptor VQL

Use this artifact to hunt endpoints for processes running from user-writable paths that hold active outbound connections — the ValleyRAT persistence-plus-C2 pattern — and cross-check them against recently created Run keys.

-- Hunt for processes executing from user-writable directories with active network connections
SELECT Pid, Name, Exe, CommandLine, Username,
       netstat() AS Connections
FROM pslist()
WHERE Exe =~ '(?i)AppData|ProgramData|Temp'
  AND Name !~ '(?i)onedrive|teams|slack|spotify|webex|zoom'

Follow up on hits by pulling the autostart entries for the same host:

-- Correlate with Run-key persistence entries
SELECT Key.FullPath AS KeyPath, Name, Data.value AS Value
FROM read_reg_key(globs='HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*\*',
                  accessor='registry')
WHERE Value =~ '(?i)AppData|ProgramData|Temp'

Hardening & Verification Script

Run this PowerShell on Windows endpoints (or via your RMM at scale) to surface the artifacts most relevant to these campaigns: suspicious autostart entries from user-writable paths, recently modified browser session stores, and evidence of security-tool tampering.

# --- Audit Run/RunOnce keys for persistence from user-writable paths ---
$paths = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
           'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
           'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
           'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($p in $paths) {
  Get-ItemProperty -Path $p -ErrorAction SilentlyContinue | ForEach-Object {
    $_.PSObject.Properties | Where-Object {
      $_.Value -match 'AppData|ProgramData|Temp' -and $_.Name -notmatch '^PS'
    } | Select-Object @{n='Key';e={$p}}, Name, Value
  }
}

# --- Find browser session stores modified in the last 72 hours by write activity ---
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data","$env:LOCALAPPDATA\Microsoft\Edge\User Data" `
  -Recurse -Include 'Cookies','Local State','Login Data' -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-72) } |
  Select-Object FullName, LastWriteTime

# --- Check whether Defender tamper protection and real-time monitoring are intact ---
Get-MpPreference | Select-Object DisableRealtimeMonitoring, DisableBehaviorMonitoring, DisableIOAVProtection
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, IsTamperProtected

# --- List recently created executables in user-writable directories (last 7 days) ---
Get-ChildItem "$env:APPDATA","$env:LOCALAPPDATA\Temp","C:\ProgramData" -Recurse `
  -Include '*.exe','*.dll','*.ps1','*.bat' -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) } |
  Select-Object FullName, CreationTime, LastWriteTime | Sort-Object CreationTime -Descending

Remediation

If infostealer activity is confirmed on a host:

1. Isolate first, remediate second. Especially with Gryxa-class anti-remediation behavior, network-isolate the host (EDR network containment, not just disabling the NIC from the console) before killing processes. Assume the malware is watching your response.
2. Revoke every session, not just passwords. For any user on an affected host: force sign-out of all sessions on claude.ai / Anthropic Console, Microsoft Entra ID (revoke refresh tokens), Google, Okta, GitHub, and any other SaaS in the browser profile. Password resets alone do nothing against a stolen session cookie. In Entra: RevokeSignInSessions. For Claude and most SaaS: use the platform's "sign out all devices" and rotate API keys.
3. Reimage, don't clean. Infostealers frequently drop second-stage payloads. Given ValleyRAT's adware camouflage and Gryxa's watcher logic, the only defensible end state for a confirmed stealer infection is a rebuild from known-good media.
4. Hunt laterally. Pull the KQL results environment-wide; stealers rarely hit one machine. Check for the same C2 destinations in proxy and firewall logs across the fleet.
5. Re-validate "adware" alerts. Search your ticket history for PUP/adware detections closed without investigation in the last 90 days on hosts that later accessed sensitive systems. Reopen anything with coincident persistence or new outbound connections.

For hypervisor / Fire Ant exposure:

• Forward ESXi logs (hostd.log, vpxa.log, shell logs) and vCenter events to your SIEM — most environments I assess have this gap.
• Enable ESXi lockdown mode where operationally feasible; restrict SSH to break-glass only and alert on every enablement.
• Alert on new local ESXi accounts, unexpected esxcli/vim-cmd usage, and any management-interface traffic to non-vCenter/backup destinations.
• Audit vSphere permissions and service accounts; rotate credentials for any account with hypervisor management rights if compromise is suspected.

Strategic hardening:

• Phishing-resistant MFA everywhere, plus token protection. Where supported (Entra ID token binding, Chrome's device-bound session credentials as adoption grows), bind session tokens to the device. This is the structural fix for session-cookie replay.
• Restrict browser profile access. Deploy attack surface reduction rules and application control to block non-browser processes from reading credential stores — this single control breaks the entire infostealer class.
• Treat AI platform accounts as Tier-0-adjacent assets. They hold your developers' code, your analysts' queries, and increasingly your internal knowledge. Inventory them, put them behind SSO with conditional access, and monitor session anomalies.
• Fix your PUP triage process. Adware verdicts must trigger a minimum check: new persistence? new outbound connections? new local accounts? Any yes escalates to malware IR.

The throughline of Round 113 is that attackers are investing in the seams of your security program — session tokens instead of passwords, hypervisors instead of endpoints, "adware" instead of obvious malware. Your detection strategy has to meet them there.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub