Aokigahara (Aoki) infostealer steals AI assistant sessions, Git, SSH and cloud credentials from developer endpoints

Linha do tempo

1. darkreading.com ↗ · pub. 27/10/2026 13:47 · coletado 27/10 15:00 só resumo do feed

   Aokigahara infostealer targets developer credentials and AI assistant sessions on compromised endpoints

   ler a análise desta fonte ocultar

   A newly reported infostealer dubbed Aokigahara goes after what the article calls "developer keyrings" and AI assistants. It extends the traditional infostealer playbook to AI tools. According to the report, a single compromised endpoint can expose AI sessions, sensitive business data and developer infrastructure. The available text is limited to the headline and standfirst, so the delivery method, technical capabilities, attribution, victims and indicators are not stated.

2. gbhackers.com ↗ · pub. 26/10/2026 10:16 · coletado 26/10 12:00

   Aokigahara infostealer targets AI coding assistants, SSH keys and cloud credentials on developer workstations

   ler a análise desta fonte ocultar

   Check Point Research documented Aokigahara, an infostealer seen in the wild that extends credential theft from browsers and crypto wallets to AI coding tools and developer environments. Targeted products include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and JetBrains AI Assistant. The malware does not exploit a vulnerability. It searches local application storage for token and configuration files. Symantec's Threat Hunter Team tracks the same malware as Aoki, and its findings indicate AI credential collection was added in newer versions. Earlier versions may have circulated as Kamidere or Stygian. Check Point does not establish how operators monetize the stolen data or whether every collected session remains valid.

   Technical Details

   • A dedicated aisessions handler collects Codex authentication and configuration files, Claude credentials, Cursor and Windsurf state databases, and GitHub Copilot storage. It also covers Amazon Q, Kiro, AWS credentials and AWS SSO caches, and queries Windows Credential Manager.
   • A separate ide handler searches Visual Studio Code, Cursor, Windsurf and JetBrains products. It collects Git credential files, .ssh files that may hold private keys, and AWS, Azure and Google Cloud credential and configuration files.
   • Traditional stealer capabilities remain: browser password and cookie theft, screenshots, clipboard collection, crypto wallet harvesting, and theft from messaging, email, VPN, FTP and password-manager applications. A separate dropped component manipulates the clipboard, and its targeted wallet formats are unconfirmed.
   • The encrypted configuration sits in the .stgcfg section and is decrypted with AES-256-CBC. It defines C2 infrastructure, a server X25519 public key, module selection, certificate-pinning settings and fallback URLs. Disabled modules stay embedded in the executable.
   • Exfiltration uses the endpoints /gate/handshake, /gate/chunk and /gate/complete. An X25519 exchange and SHA-256 derive the key used to encrypt ZIP archives with AES-256-GCM. The completion message does not confirm that every transfer succeeded.
   • Optional anti-analysis checks cover debuggers, virtualization artifacts, hardware resources, process counts, cursor movement and suspicious account names. Configurable language checks can also terminate execution.
   • Recent samples use the User-Agent Microsoft-CryptoAPI/10.0.

   Remediation

   The article gives no explicit remediation. Practical impact depends on credential validity, permissions and whether the collected files contain recoverable secrets. Stolen secrets could give access to AI accounts, repositories, cloud resources and connected development services.

3. blog.checkpoint.com ↗ · pub. 23/10/2026 10:00 · coletado 23/10 14:00

   Aokigahara infostealer targets AI assistant sessions, Git, SSH and cloud credentials on developer endpoints

   ler a análise desta fonte ocultar

   Check Point Research (CPR) analyzed Aokigahara, a newly observed infostealer seen in the wild that explicitly targets authentication files, session data and configuration files of AI applications and developer tools. Targeted tools include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and JetBrains AI Assistant. Alongside the usual browser, wallet, email, password manager and VPN theft, it also collects Git credentials, SSH-related files and AWS, Azure and Google Cloud credentials. Valid stolen tokens could expose private conversations, source code and paid AI services. CPR has not confirmed that the operators reuse, resell or monetize the stolen AI credentials, and it does not establish that the AI and developer modules are chained into a single attack path.

   Technical Details

   • Dedicated collection modules: one for AI applications (auth tokens, credentials, session data, configuration files) and a separate one for the development environment (Git credential files, SSH-related files that may hold private keys, cloud credential and configuration files).
   • Traditional stealer scope: browser passwords and cookies, cryptocurrency wallets, email applications, password managers and VPNs.
   • Exfiltration: collected data is separated by category (including a dedicated AI session data category), packaged into encrypted ZIP archives and uploaded to the attacker's command-and-control server.
   • Not every targeted file necessarily holds a secret. The article states that valid tokens could let an attacker access an AI service without the user's password.
   • The article gives no IOCs, delivery vector or attribution.

   Remediation

   • Treat AI tokens, authentication files and application sessions as sensitive credentials.
   • Set policies on what source code and business data may be entered into AI services.
   • Protect Git credentials, SSH keys and cloud credentials stored on developer endpoints.
   • Monitor endpoints for infostealer activity.
   • After an endpoint compromise, include AI sessions and credentials in the credential exposure review alongside browser, cloud and developer credentials.
4. research.checkpoint.com ↗ · pub. 23/10/2026 10:00 · coletado 23/10 12:00

   Aokigahara infostealer targets AI applications, developer tools and cloud credentials alongside traditional data theft

   ler a análise desta fonte ocultar

   Check Point Research describes Aokigahara, a newly observed Windows infostealer that may have appeared in earlier versions as Kamidere or Stygian. It combines standard theft of browser, cryptocurrency wallet, VPN, FTP/SFTP, password manager and email data with a dedicated aisessions handler. That handler collects authentication, session and configuration files for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. It also collects Git credentials, SSH private keys, and AWS, Azure and Google Cloud credential files. Stolen tokens could allow unauthorized use or resale of paid AI accounts, exposure of private conversations and source code, and data extortion. The report does not confirm how the operators actually monetize the data. The stealer is under active development, and the latest samples use the User-Agent Microsoft-CryptoAPI/10.0.

   Technical Details

   • Capabilities include screenshot and clipboard capture, browser credential and cookie theft, wallet theft, file grabbing and a clipper handler that drops a separate component. It also targets Discord, Telegram, Steam, Roblox and Minecraft.
   • Anti-analysis: API hashing, control-flow flattening around configuration decryption, and optional checks (each enabled by a configuration flag). The checks cover keyboard layout and UI language (bitmask 0x6C0400C8601), debugger detection (PEB, debug port and object, DR0–DR3), and VM and sandbox detection (CPUID, registry, processes, SMBIOS, usernames, hardware resources, cursor movement).
   • Configuration: an AES-256-CBC encrypted blob in the .stgcfg section with magic STGC. The key is derived from a seed with an FNV-style routine. The configuration holds the C&C URL, the server X25519 public key, build ID, gate token, module bitmask, TLS pinning settings and up to three fallback URLs. All modules stay embedded in the executable even when disabled.
   • C&C protocol: an X25519 key exchange, with the AES-GCM key derived via SHA-256 and the string aokigahara. The malware sends POST /gate/handshake, then uploads AES-GCM-encrypted ZIP archives per module to /gate/chunk with X-Chunk labels such as sysinfo, browsers, firefox and aisessions. It ends with POST /gate/complete carrying the body COMPLETE.
   • Check Point published a YARA rule keyed on strings such as AKGRES, AISessions/, aokigahara, kamidere and the pipe name \\.\pipe\akg_%lx_%lx.

   Remediation

   • Treat AI application credentials and session tokens as sensitive assets, equal to browser sessions, cloud credentials and developer keys.
   • Rotate AI service tokens, API keys, SSH keys and cloud credentials on hosts suspected of infection, and use the published YARA rule and network indicators for hunting.
5. infosecurity-magazine.com ↗ · pub. 15/10/2026 10:00 · coletado 20/10 16:31 primeiro registro

   Aoki infostealer adds theft of AI coding assistant credentials, tokens and session files

   ler a análise desta fonte ocultar

   Symantec's Threat Hunter Team reports that new versions of the Aoki infostealer now target credential and session files used by AI coding assistants. Earlier versions focused on browser, cryptocurrency wallet and password manager data. Aoki is a relatively new and sparsely documented stealer, first observed earlier in 2026, and its AI-related capabilities are recent and appear to be expanding. Symantec does not know which group is behind it and sees no links to any existing malware family. The focus on cryptocurrency wallets and extensions suggests the operators are financially motivated.

   Technical Details

   • The newest observed version targets .claude.json, Claude desktop cookies, ChatGPT cookies, and the Codex config.toml and .env files.
   • It also steals tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, along with AWS credentials.
   • Stolen keys and tokens let an attacker act under a legitimate developer's identity and API quota, bypassing safeguards that assume requests come from a trusted user.
   • The tokens can also expose connected repositories, cloud services and CI/CD pipelines linked to the account.
   • Stolen AI keys can be resold or used to run up usage on the victim's account (LLMjacking). Symantec assesses that threat actors now value AI credentials as highly as payment card data and crypto wallets.

   Remediation

   The article gives no specific remediation guidance.