VULNpocalypse
HighEcosystem changeMonitoring

Aoki and Aokigahara infostealers target AI coding assistant credentials

Infostealers dubbed Aoki and Aokigahara steal AI coding assistant tokens and cloud keys, so rotate them if a developer machine may be infected.

Published
Updated
Exploitation
Not confirmed, Symantec’s Threat Hunter Team found the newest Aoki version and Check Point discovered Aokigahara, but neither source reports victims

What happened

Two security vendors have published research on infostealer malware that targets credentials for AI coding assistants. The two outlets report different names and different researchers. The sources do not confirm whether the two names refer to the same malware family.

Aoki (Symantec). Infosecurity Magazine reported on a Symantec report published on October 15. It describes Aoki as a relatively new and sparsely documented infostealer, first observed earlier in 2026. Earlier versions went after browser data, cryptocurrency wallets and password manager data. The newest version found by Symantec’s Threat Hunter Team adds the following targets:

  • .claude.json
  • Claude desktop cookies and ChatGPT cookies
  • the Codex config.toml and .env files
  • tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro
  • Amazon Web Services (AWS) credentials

Symantec said the stealer’s capabilities “still appear to be in active development”. It does not know which group is behind Aoki and has seen no links to any existing malware family. It believes the attackers are financially motivated because the stealer also focuses on cryptocurrency wallets and extensions (Infosecurity Magazine).

Aokigahara (Check Point). Dark Reading reported on a Check Point report about a stealer called Aokigahara. According to Check Point:

  • It targets Windows-based machines.
  • It steals from browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers and email applications.
  • It also collects authentication files, session data and configuration files for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and other tools.
  • It searches for Git access data, SSH keys, and AWS, Azure and Google Cloud configuration files.
  • It checks for virtual machines and sandboxes.
  • It packs stolen data into zip archives and encrypts them before sending them to attacker-controlled servers.

Why the stolen data matters. Both reports describe what the stolen data can be used for:

  • Symantec says stolen tokens let an attacker act under a legitimate developer’s identity and API quota. They can also expose connected repositories, cloud services and CI/CD pipelines (Infosecurity Magazine).
  • Check Point mentions resale of accounts and unauthorized use of paid AI services. It also mentions possible extortion if stolen sessions give access to conversation histories or uploaded files (Dark Reading).

The sources do not confirm these details: how either stealer is delivered, indicators of compromise, victim numbers, or confirmed infections.

Am I affected?

You may be exposed if a workstation where you use Claude, ChatGPT, Codex, Cursor, Windsurf, GitHub Copilot, Gemini, JetBrains AI Assistant or Kiro has been infected with an infostealer.

  • Check Point says Aokigahara targets Windows (Dark Reading). The Infosecurity Magazine report does not say which operating systems Aoki targets, so this is not confirmed.
  • The sources do not describe a vulnerability in the AI tools. The stealers read credential and session files already stored on an infected machine.
  • Other long-lived secrets on an infected machine are also at risk: Git credentials, SSH private keys, AWS, Azure or Google Cloud config files, and .env files.

What to do now

These steps are Check Point’s recommendations as reported by Dark Reading.

  1. If an endpoint is suspected of compromise, check more than browser passwords. Check AI sessions, API keys, GitHub credentials, SSH keys and cloud tokens.
  2. Revoke exposed sessions and rotate secrets for the affected AI tools and developer accounts.
  3. Treat AI-tool authentication data as enterprise secrets and protect it like cloud credentials and developer keys.
  4. Hunt for suspicious access to local application storage and authentication files belonging to AI assistants, coding agents and developer IDEs.
  5. Reduce long-lived secrets on endpoints. Use managed identity and short-lived credentials where feasible, and restrict access to cloud resources and source-code repositories.

Sources