Webz.io announced Token Exposure Monitoring, a capability that identifies, attributes, and validates API keys, OAuth tokens, personal access tokens, and other machine credentials stolen from developer and employee endpoints. The launch responds to the growing presence of persistent machine identities on workstations that are increasingly targeted by malware. The new feature is available in the Lunar Essential and PRO tiers of the company's intelligence platform.
The Growing Risk of Machine Credentials on Endpoints
The rapid adoption of AI development tools, cloud platforms, and automated infrastructure has placed a new class of credentials directly on developer machines. API keys, OAuth tokens, and personal access tokens provide direct access to valuable services such as AWS, GitHub, OpenAI, Anthropic, Slack, and Okta. Security researchers have documented the theft and abuse of AI API credentials for attacks such as LLMjacking.
How Tokens Are Stolen from Developer Machines
Developers routinely authenticate to these cloud and development platforms from their workstations, and tokens can be stored in .env files, application configuration, CLI authentication files, shell history, browser data, and local caches. Modern infostealers use file grabber components to collect exactly this type of endpoint data. The growing use of AI development tools has expanded that exposure because persistent API and OAuth credentials are increasingly used by AI APIs, command-line agents, and developer environments.
From Anonymous Token to Actionable Incident
Machine credentials create an intelligence challenge that differs from traditional compromised passwords. An exposed corporate email address carries its organizational identity inside the credential, while an API token generally appears as an opaque string with little indication of who owns it. The new capability is designed to turn those anonymous tokens into actionable security incidents.
Interface and Validation Capabilities
The Token Exposure interface provides access to the exposed credential, affected employee, service, internal file path, original log context, malware metadata, and other information collected from the compromised endpoint. Analysts can search and filter exposures by service, employee, token type, breach date, severity, and validation state. This context helps security teams understand who a credential belongs to and what needs to be revoked.
Extending Infostealer Response Beyond Passwords
Most infostealer response processes center on cleaning the infected endpoint, resetting passwords, and invalidating browser sessions. Machine credentials introduce another remediation path because API keys, personal access tokens, OAuth tokens, and other secrets frequently follow independent authentication lifecycles. They can remain usable until they are rotated or revoked, so incident response teams need to include them in their recovery workflows.
Executive Perspective
Ran Geva, Founder and CEO of Webz.io, said developer tokens have become valuable credentials because a stolen AI key can be converted into compute almost immediately. He added that GitHub tokens can provide source code access and cloud credentials can open infrastructure. Geva also noted that passwords and cookies have been at the center of infostealer response for years, and developer tokens now deserve the same treatment.
Availability
Token Exposure Monitoring is available in the Lunar Essential and PRO tiers of Webz.io's intelligence platform. The feature extends the company's cyber intelligence monitoring capabilities to include machine credentials stolen from developer and employee endpoints. Security teams can use it to detect exposed credentials before unauthorized access, and the capability complements repository secret scanning, secrets management, and other non-human identity security products.
As AI adoption accelerates, the security industry must adapt to the reality that developer tokens and machine identities are now prime targets for infostealers. Webz.io's Token Exposure Monitoring brings these opaque credentials into the incident response workflow with attribution, context, and validation. The launch reflects a broader shift from protecting only passwords and sessions toward managing the full lifecycle of machine credentials on endpoints.