Djinn Stealer AI Tool Credential File Bulk Collection (MCP/Claude/Codex/Gemini)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects unauthorized mass access to AI development tool configuration files and credentials. The rule identifies processes reading sensitive files associated with tools such as Claude (mcp.json, projects), Codex (config.toml, sessions), Gemini (settings.json, .env), Cline, OpenCode, and Kilo.