/
← Voltar ao feed
medium technology software development

Aokigahara infostealer targets AI assistant sessions, Git, SSH and cloud credentials on developer endpoints

1 fonte(s) · 1 atualização(ões) · publicado 23/10/2026 10:00 · coletado há 7 horas

Check Point Research (CPR) analyzed Aokigahara, a newly observed infostealer seen in the wild that explicitly targets authentication files, session data and configuration files of AI applications and developer tools. Targeted tools include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and JetBrains AI Assistant. Alongside the usual browser, wallet, email, password manager and VPN theft, it also collects Git credentials, SSH-related files and AWS, Azure and Google Cloud credentials. Valid stolen tokens could expose private conversations, source code and paid AI services. CPR has not confirmed that the operators reuse, resell or monetize the stolen AI credentials, and it does not establish that the AI and developer modules are chained into a single attack path.

Detalhes técnicos

  • Dedicated collection modules: one for AI applications (auth tokens, credentials, session data, configuration files) and a separate one for the development environment (Git credential files, SSH-related files that may hold private keys, cloud credential and configuration files).
  • Traditional stealer scope: browser passwords and cookies, cryptocurrency wallets, email applications, password managers and VPNs.
  • Exfiltration: collected data is separated by category (including a dedicated AI session data category), packaged into encrypted ZIP archives and uploaded to the attacker's command-and-control server.
  • Not every targeted file necessarily holds a secret. The article states that valid tokens could let an attacker access an AI service without the user's password.
  • The article gives no IOCs, delivery vector or attribution.

Remediação

  • Treat AI tokens, authentication files and application sessions as sensitive credentials.
  • Set policies on what source code and business data may be entered into AI services.
  • Protect Git credentials, SSH keys and cloud credentials stored on developer endpoints.
  • Monitor endpoints for infostealer activity.
  • After an endpoint compromise, include AI sessions and credentials in the credential exposure review alongside browser, cloud and developer credentials.

Linha do tempo

  1. blog.checkpoint.com ↗ · pub. 23/10/2026 10:00 · coletado 23/10 14:00 primeiro registro

    Aokigahara infostealer targets AI assistant sessions, Git, SSH and cloud credentials on developer endpoints

    ler a análise desta fonte

    Check Point Research (CPR) analyzed Aokigahara, a newly observed infostealer seen in the wild that explicitly targets authentication files, session data and configuration files of AI applications and developer tools. Targeted tools include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and JetBrains AI Assistant. Alongside the usual browser, wallet, email, password manager and VPN theft, it also collects Git credentials, SSH-related files and AWS, Azure and Google Cloud credentials. Valid stolen tokens could expose private conversations, source code and paid AI services. CPR has not confirmed that the operators reuse, resell or monetize the stolen AI credentials, and it does not establish that the AI and developer modules are chained into a single attack path.

    Technical Details

    • Dedicated collection modules: one for AI applications (auth tokens, credentials, session data, configuration files) and a separate one for the development environment (Git credential files, SSH-related files that may hold private keys, cloud credential and configuration files).
    • Traditional stealer scope: browser passwords and cookies, cryptocurrency wallets, email applications, password managers and VPNs.
    • Exfiltration: collected data is separated by category (including a dedicated AI session data category), packaged into encrypted ZIP archives and uploaded to the attacker's command-and-control server.
    • Not every targeted file necessarily holds a secret. The article states that valid tokens could let an attacker access an AI service without the user's password.
    • The article gives no IOCs, delivery vector or attribution.

    Remediation

    • Treat AI tokens, authentication files and application sessions as sensitive credentials.
    • Set policies on what source code and business data may be entered into AI services.
    • Protect Git credentials, SSH keys and cloud credentials stored on developer endpoints.
    • Monitor endpoints for infostealer activity.
    • After an endpoint compromise, include AI sessions and credentials in the credential exposure review alongside browser, cloud and developer credentials.