Djinn Stealer AI Coding Assistant Credential and Config File Access on Linux

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the Djinn Stealer malware accessing sensitive configuration files and credential stores related to AI coding assistants (e.g., Claude, Codex, Gemini, Cline) and common development utilities (e.g., AWS, GKE, SSH) on Linux workstations. It also detects the creation of a 'linux-process-env.json' file, which is an artifact used by the stealer to exfiltrate environment variables harvested from process memory.