Djinn Stealer AI Credential File Collection — Claude/Codex/Gemini/Cline/Kilo/OpenCode

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects processes accessing sensitive files on a Linux system, such as SSH private keys, shell history files, and various application-specific configuration or credential files (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). The rule excludes common system processes like shells, SSH daemons, git, and curl to minimize noise while identifying suspicious file access.