Aokigahara infostealer steals AI assistant sessions, Git, SSH and cloud credentials from developer endpoints

Linha do tempo

1. blog.checkpoint.com ↗ · pub. 23/10/2026 10:00 · coletado 23/10 14:00

   Aokigahara infostealer targets AI assistant sessions, Git, SSH and cloud credentials on developer endpoints

   ler a análise desta fonte ocultar

   Check Point Research (CPR) analyzed Aokigahara, a newly observed infostealer seen in the wild that explicitly targets authentication files, session data and configuration files of AI applications and developer tools. Targeted tools include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and JetBrains AI Assistant. Alongside the usual browser, wallet, email, password manager and VPN theft, it also collects Git credentials, SSH-related files and AWS, Azure and Google Cloud credentials. Valid stolen tokens could expose private conversations, source code and paid AI services. CPR has not confirmed that the operators reuse, resell or monetize the stolen AI credentials, and it does not establish that the AI and developer modules are chained into a single attack path.

   Technical Details

   • Dedicated collection modules: one for AI applications (auth tokens, credentials, session data, configuration files) and a separate one for the development environment (Git credential files, SSH-related files that may hold private keys, cloud credential and configuration files).
   • Traditional stealer scope: browser passwords and cookies, cryptocurrency wallets, email applications, password managers and VPNs.
   • Exfiltration: collected data is separated by category (including a dedicated AI session data category), packaged into encrypted ZIP archives and uploaded to the attacker's command-and-control server.
   • Not every targeted file necessarily holds a secret. The article states that valid tokens could let an attacker access an AI service without the user's password.
   • The article gives no IOCs, delivery vector or attribution.

   Remediation

   • Treat AI tokens, authentication files and application sessions as sensitive credentials.
   • Set policies on what source code and business data may be entered into AI services.
   • Protect Git credentials, SSH keys and cloud credentials stored on developer endpoints.
   • Monitor endpoints for infostealer activity.
   • After an endpoint compromise, include AI sessions and credentials in the credential exposure review alongside browser, cloud and developer credentials.
2. research.checkpoint.com ↗ · pub. 23/10/2026 10:00 · coletado 23/10 12:00 primeiro registro

   Aokigahara infostealer targets AI applications, developer tools and cloud credentials alongside traditional data theft

   ler a análise desta fonte ocultar

   Check Point Research describes Aokigahara, a newly observed Windows infostealer that may have appeared in earlier versions as Kamidere or Stygian. It combines standard theft of browser, cryptocurrency wallet, VPN, FTP/SFTP, password manager and email data with a dedicated aisessions handler. That handler collects authentication, session and configuration files for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. It also collects Git credentials, SSH private keys, and AWS, Azure and Google Cloud credential files. Stolen tokens could allow unauthorized use or resale of paid AI accounts, exposure of private conversations and source code, and data extortion. The report does not confirm how the operators actually monetize the data. The stealer is under active development, and the latest samples use the User-Agent Microsoft-CryptoAPI/10.0.

   Technical Details

   • Capabilities include screenshot and clipboard capture, browser credential and cookie theft, wallet theft, file grabbing and a clipper handler that drops a separate component. It also targets Discord, Telegram, Steam, Roblox and Minecraft.
   • Anti-analysis: API hashing, control-flow flattening around configuration decryption, and optional checks (each enabled by a configuration flag). The checks cover keyboard layout and UI language (bitmask 0x6C0400C8601), debugger detection (PEB, debug port and object, DR0–DR3), and VM and sandbox detection (CPUID, registry, processes, SMBIOS, usernames, hardware resources, cursor movement).
   • Configuration: an AES-256-CBC encrypted blob in the .stgcfg section with magic STGC. The key is derived from a seed with an FNV-style routine. The configuration holds the C&C URL, the server X25519 public key, build ID, gate token, module bitmask, TLS pinning settings and up to three fallback URLs. All modules stay embedded in the executable even when disabled.
   • C&C protocol: an X25519 key exchange, with the AES-GCM key derived via SHA-256 and the string aokigahara. The malware sends POST /gate/handshake, then uploads AES-GCM-encrypted ZIP archives per module to /gate/chunk with X-Chunk labels such as sysinfo, browsers, firefox and aisessions. It ends with POST /gate/complete carrying the body COMPLETE.
   • Check Point published a YARA rule keyed on strings such as AKGRES, AISessions/, aokigahara, kamidere and the pipe name \\.\pipe\akg_%lx_%lx.

   Remediation

   • Treat AI application credentials and session tokens as sensitive assets, equal to browser sessions, cloud credentials and developer keys.
   • Rotate AI service tokens, API keys, SSH keys and cloud credentials on hosts suspected of infection, and use the published YARA rule and network indicators for hunting.