/
← Voltar ao feed
high technology software development

Aokigahara infostealer targets AI applications, developer tools and cloud credentials alongside traditional data theft

1 fonte(s) · 1 atualização(ões) · publicado 23/10/2026 10:00 · coletado há 5 horas

Check Point Research describes Aokigahara, a newly observed Windows infostealer that may have appeared in earlier versions as Kamidere or Stygian. It combines standard theft of browser, cryptocurrency wallet, VPN, FTP/SFTP, password manager and email data with a dedicated aisessions handler. That handler collects authentication, session and configuration files for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. It also collects Git credentials, SSH private keys, and AWS, Azure and Google Cloud credential files. Stolen tokens could allow unauthorized use or resale of paid AI accounts, exposure of private conversations and source code, and data extortion. The report does not confirm how the operators actually monetize the data. The stealer is under active development, and the latest samples use the User-Agent Microsoft-CryptoAPI/10.0.

Detalhes técnicos

  • Capabilities include screenshot and clipboard capture, browser credential and cookie theft, wallet theft, file grabbing and a clipper handler that drops a separate component. It also targets Discord, Telegram, Steam, Roblox and Minecraft.
  • Anti-analysis: API hashing, control-flow flattening around configuration decryption, and optional checks (each enabled by a configuration flag). The checks cover keyboard layout and UI language (bitmask 0x6C0400C8601), debugger detection (PEB, debug port and object, DR0–DR3), and VM and sandbox detection (CPUID, registry, processes, SMBIOS, usernames, hardware resources, cursor movement).
  • Configuration: an AES-256-CBC encrypted blob in the .stgcfg section with magic STGC. The key is derived from a seed with an FNV-style routine. The configuration holds the C&C URL, the server X25519 public key, build ID, gate token, module bitmask, TLS pinning settings and up to three fallback URLs. All modules stay embedded in the executable even when disabled.
  • C&C protocol: an X25519 key exchange, with the AES-GCM key derived via SHA-256 and the string aokigahara. The malware sends POST /gate/handshake, then uploads AES-GCM-encrypted ZIP archives per module to /gate/chunk with X-Chunk labels such as sysinfo, browsers, firefox and aisessions. It ends with POST /gate/complete carrying the body COMPLETE.
  • Check Point published a YARA rule keyed on strings such as AKGRES, AISessions/, aokigahara, kamidere and the pipe name \\.\pipe\akg_%lx_%lx.

Remediação

  • Treat AI application credentials and session tokens as sensitive assets, equal to browser sessions, cloud credentials and developer keys.
  • Rotate AI service tokens, API keys, SSH keys and cloud credentials on hosts suspected of infection, and use the published YARA rule and network indicators for hunting.

Linha do tempo

  1. research.checkpoint.com ↗ · pub. 23/10/2026 10:00 · coletado 23/10 12:00 primeiro registro

    Aokigahara infostealer targets AI applications, developer tools and cloud credentials alongside traditional data theft

    ler a análise desta fonte

    Check Point Research describes Aokigahara, a newly observed Windows infostealer that may have appeared in earlier versions as Kamidere or Stygian. It combines standard theft of browser, cryptocurrency wallet, VPN, FTP/SFTP, password manager and email data with a dedicated aisessions handler. That handler collects authentication, session and configuration files for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. It also collects Git credentials, SSH private keys, and AWS, Azure and Google Cloud credential files. Stolen tokens could allow unauthorized use or resale of paid AI accounts, exposure of private conversations and source code, and data extortion. The report does not confirm how the operators actually monetize the data. The stealer is under active development, and the latest samples use the User-Agent Microsoft-CryptoAPI/10.0.

    Technical Details

    • Capabilities include screenshot and clipboard capture, browser credential and cookie theft, wallet theft, file grabbing and a clipper handler that drops a separate component. It also targets Discord, Telegram, Steam, Roblox and Minecraft.
    • Anti-analysis: API hashing, control-flow flattening around configuration decryption, and optional checks (each enabled by a configuration flag). The checks cover keyboard layout and UI language (bitmask 0x6C0400C8601), debugger detection (PEB, debug port and object, DR0–DR3), and VM and sandbox detection (CPUID, registry, processes, SMBIOS, usernames, hardware resources, cursor movement).
    • Configuration: an AES-256-CBC encrypted blob in the .stgcfg section with magic STGC. The key is derived from a seed with an FNV-style routine. The configuration holds the C&C URL, the server X25519 public key, build ID, gate token, module bitmask, TLS pinning settings and up to three fallback URLs. All modules stay embedded in the executable even when disabled.
    • C&C protocol: an X25519 key exchange, with the AES-GCM key derived via SHA-256 and the string aokigahara. The malware sends POST /gate/handshake, then uploads AES-GCM-encrypted ZIP archives per module to /gate/chunk with X-Chunk labels such as sysinfo, browsers, firefox and aisessions. It ends with POST /gate/complete carrying the body COMPLETE.
    • Check Point published a YARA rule keyed on strings such as AKGRES, AISessions/, aokigahara, kamidere and the pipe name \\.\pipe\akg_%lx_%lx.

    Remediation

    • Treat AI application credentials and session tokens as sensitive assets, equal to browser sessions, cloud credentials and developer keys.
    • Rotate AI service tokens, API keys, SSH keys and cloud credentials on hosts suspected of infection, and use the published YARA rule and network indicators for hunting.