New Malware Targets AI Coding Tools to Steal Login Tokens, SSH Keys, and Cloud Credentials

A newly observed infostealer called Aokigahara is targeting AI coding assistants, developer workstations, and cloud credentials, expanding credential theft beyond browsers and cryptocurrency wallets.

The targets include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant.

Rather than exploiting an identified vulnerability in these products, the malware searches local application storage for potentially valuable files. However, not every targeted configuration file necessarily contains usable authentication secrets.

Aokigahara’s dedicated aisessions handler collects Codex authentication and configuration files, Claude credentials, Cursor and Windsurf state databases, and GitHub Copilot storage.

Its collection scope also covers Amazon Q, Kiro, AWS credentials, and AWS single sign-on caches. The routine additionally queries Windows Credential Manager, extending collection beyond ordinary files.

Usable tokens could let attackers access compromised AI accounts, consume paid services, or expose private conversations and development information. Reselling access represents another potential monetization route.

Check Point’s analysis, however, does not establish how the operators actually monetize stolen material or confirm that every collected session remains valid.

Related research from Symantec’s Threat Hunter Team tracks the malware as Aoki, also known as Aokigahara.

Its findings indicate that AI credential collection appeared in newer versions, connecting the latest analysis to an evolving theft capability rather than an entirely separate malware family.

Check Point Research documented the malware, in the wild and identified dedicated routines that collect authentication files, session data, and configuration files from widely used AI applications. Earlier versions may have circulated as Kamidere or Stygian.

AI Coding Tools Targeted

A separate ide handler searches code editors and development environments, including Visual Studio Code, Cursor, Windsurf, and JetBrains products.

Targets include Git credential files, files under .ssh that may contain private keys, and AWS, Azure, and Google Cloud credential and configuration files. Matching contents pass to the malware’s upload routine.

This creates potential exposure beyond individual AI subscriptions. Valid stolen secrets could provide access to repositories, cloud resources, and connected development services.

The practical impact depends on credential validity, permissions, and whether collected files actually contain recoverable secrets.

Traditional capabilities remain extensive: browser password and cookie theft, screenshots, clipboard collection, cryptocurrency wallet harvesting, and theft from messaging, email, VPN, FTP, and password-management applications.

A separate dropped component handles clipboard manipulation; its targeted wallet formats remain unconfirmed.

The malware stores its encrypted configuration in the .stgcfg section and decrypts it using AES-256-CBC.

Configuration fields define command-and-control infrastructure, a server X25519 public key, module selection, certificate-pinning settings, and fallback URLs. Disabled modules remain embedded in the executable.

Exfiltration uses /gate/handshake, /gate/chunk, and /gate/complete. An X25519 exchange establishes shared key material, while SHA-256 derives the key used to encrypt collected ZIP archives with AES-256-GCM.

Upload headers identify collection modules and chunk sequence numbers.

The completion message marks the upload phase’s end, not independent confirmation that every transfer succeeded.

Optional anti-analysis checks inspect debugger indicators, virtualization artifacts, hardware resources, process counts, cursor movement, and suspicious account names.

Configurable language checks can also terminate execution. Together, these controls complicate automated analysis while allowing operators to select collection capabilities for individual builds.

Recent samples communicate using the Microsoft-CryptoAPI/10.0 User-Agent, reflecting continued development across analyzed versions and configuration changes.

IOCs

Type	Value
Aokigahara SHA1	007137599bc4d69ee952a5228b5fcb2c3b9a95a7
Aokigahara SHA1	00d52c7e759d878f0d8a117502f6d854af13f007
Aokigahara SHA1	04eddccb79db41e03a4ee8542e8a33d7f1d9fe18
Aokigahara SHA1	057a2d1dedeb93b7765c455a9e0c469e7cbe4843
Aokigahara SHA1	079ddf5cc7d6ca2e02f860f87d4d18c83db9d331
Aokigahara SHA1	0b74ce90a39278fb97fe94f6306af71cbe679503
Aokigahara SHA1	0c46ac5555cf8f305c1345a21d0802c52bf52cd8

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.