The Aoki infostealer, also known as Aokigahara, has expanded its collection capabilities to steal credentials and session files from AI coding assistants, putting developer identities and connected infrastructure at risk.
First observed earlier in 2026, Aoki previously lacked collection routines for AI applications.
Their appearance in recent samples indicates active development, with attackers broadening their targets to include authentication material stored by increasingly popular development tools.
The findings concern credentials harvested from compromised endpoints, rather than a reported breach of the AI providers themselves.
The newest analyzed variant targets .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files.
Researchers also identified theft of tokens associated with GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, together with Amazon Web Services credentials. These artifacts extend the potential impact beyond individual chatbot accounts.
Stolen API keys, OAuth tokens and session tokens can enable attackers to operate under a legitimate developer’s identity and consume the victim’s API quota.
Depending on permissions and integrations, compromised authentication material could also expose repositories, cloud services and continuous integration and continuous delivery pipelines.
Symantec’s Threat Hunter Team identified newer variants, targeting Claude, ChatGPT, OpenAI Codex, Cursor, Codeium, and Gemini alongside conventional browser and cryptocurrency data.
Controls that trust authenticated requests may consequently provide insufficient protection against credential reuse.
The immediate opportunity includes unauthorized AI consumption, commonly called LLMjacking, or resale of access. However, researchers have not established downstream exploitation in this campaign.
Symantec also said it lacked visibility into the number of affected victims, making the distinction between demonstrated collection capabilities and confirmed operational consequences important.
Aoki retains an extensive collection scope covering browser cookies, autofill records, payment information, browsing history and Google tokens.
Targets span Chromium and Firefox families, cryptocurrency browser extensions, desktop wallets, messaging platforms, gaming clients, email applications, VPN software, FTP clients and password managers. It also identifies installed security products.
Wallet collection includes searches for filenames containing terms such as mnemonic, recovery, private_key, passphrase, keystore and 24word.
Messaging targets include Discord variants and Telegram clients, while additional routines retrieve Outlook passwords from the registry and Thunderbird profiles. Together, these capabilities expose both financial assets and reusable account access.
According to the supplied research details, Aoki primarily steals credentials, tokens and session files rather than source code.
Cursor’s local state database is an exception because it can contain cached conversation context and code snippets, potentially bringing development content into the stolen dataset.
Aoki has no backdoor command list. Instead, it gathers available information and sends it to command infrastructure through a /gate endpoint.
Most newer samples shared one domain, while two used separate domains; older variants transmitted over unencrypted HTTP to an IP address on port 8080.
Earlier public coverage appeared in CYFIRMA’s August 28 intelligence report, which documented Windows execution and network activity.
Symantec has not attributed Aoki to a known threat group or established links to another malware family.
Its expanding collection scope highlights developer authentication stores as valuable targets, while leaving the operators, distribution scale and subsequent use of stolen credentials unresolved in the available published reporting.
| SHA-256 Hash | Detection |
|---|---|
752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69 | Infostealer.Aoki |
bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf | Infostealer.Aoki |
0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3 | Infostealer.Aoki |
6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999 | Infostealer.Aoki |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
A newly disclosed proxyjacking campaign has compromised at least 143 devices across 34 countries, exploiting…
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day…
Cisco has warned that attackers are actively exploiting a zero-day flaw in the Advanced Malware…
Palo Alto Networks has warned that attackers are exploiting a high-severity remote code execution flaw…
Citizen Lab has confirmed the first public case of zero-click mercenary spyware delivered through targeted…
PEERSTITCH, a memory-resident ARM64 implant deployed against FortiGate firewalls during a prolonged intrusion into a…