Key findings
- The Aoki (aka Aokigahara) infostealer is now stealing credential and session files used by AI coding assistants, including Claude, OpenAI’s Codex, Cursor, Codeium and Gemini. Earlier versions of the malware did not target AI-related files, which indicates the capability is a recent addition.
- Stolen application programming interface (API) keys and tokens can allow attackers to carry out activity under a legitimate user’s identity and API quota. The tokens can also expose connected repositories, cloud services and continuous integration and continuous delivery (CI/CD) pipelines linked to the account.
- The most up-to-date sample of this malware analyzed by the Symantec Threat Hunter team also stole data from dozens of browsers, cryptocurrency wallets, password managers, messaging and gaming applications, and VPN and FTP clients.
- The malware has no backdoor command list. It collects whatever data is available and sends it to its command-and-control (C&C) server.
The Aoki (aka Aokigahara) infostealer has begun stealing credentials for AI coding assistants. Recent versions of Aoki analyzed by the Symantec Threat Hunter team were designed to harvest credential and session files for Claude, OpenAI’s Codex, Cursor, Codeium and Gemini, alongside the browser, cryptocurrency wallet and password manager data that infostealers typically collect.
The capability is recent and appears to be expanding. Aoki is a relatively new stealer that was first seen earlier in 2026. However, older samples did not look for AI-related files, meaning the capability was added to the malware recently.
The newest version of the threat found by the Threat Hunter Team targeted .claude.json, Claude desktop cookies, ChatGPT cookies, and the Codex config.toml and .env files. In addition, it stole tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, along with Amazon Web Services (AWS) credentials.
Wider data theft
As well as the AI-related targets, Aoki attempts to steal a wide range of other information from victim machines, including:
- Cookies, autofill data, credit card information, history and Google tokens from the following browsers: Chrome; Edge; Brave; Opera; Opera GX; Opera Neon; Vivaldi; Yandex; 360; CentBrowser; Coc Coc; Comodo Dragon; Epic; Iridium; Torch; Slimjet; URBrowser; SRWare Iron; 7Star; Amigo; Sputnik; Atom; Orbitum; QQ; Whale; Maxthon; Avast/AVG/CCleaner browsers; Kinza; Sidekick; Arc; Thorium; DuckDuckGo; Ghostery; Lunascape; Mercury; Edge WebView2; Firefox; Waterfox; LibreWolf; Pale Moon; Basilisk; SeaMonkey, and Floorp.
- Wallet browser extensions, including: MetaMask; MetaMask (Edge); Phantom; TronLink; Coinbase; Binance; Trust; Exodus; Brave; Ronin; Solflare; Slope; Rabby; Terra Station; Keplr; Sollet; Coin98; XDEFI; KardiaChain; Nami; Maiar; Temple; Yoroi; Guarda; EVER; Jaxx Liberty; BitPay; Wombat; Oxygen; Crocobit; Finnie; Kaikas; BOLT X; Liquality; Leaf; Clover; Math; GeroWallet; HashPack; Talisman; SubWallet; Polkadot{.js}; Martian; Pontem; Petra; Fewcha; OKX; Sender; TokenPocket; Backpack; Sui; Enkrypt; Core; Zerion; Rainbow; Frontier; Blade; Bitget; Compass; 1inch; Fluent; Braavos; ArgentX; Fractal; Tonkeeper; UniSat; Leather; SafePal, and Rise.
- Desktop wallets, including: Exodus; Atomic; Electrum; Electrum-LTC; Ethereum keystore; Zcash; Armory; Bytecoin; Jaxx; Guarda; Coinomi; Wasabi; Dogecoin; Dash; Litecoin; Bitcoin Core; Monero; Daedalus; Binance; Ledger Live, and TokenPocket.
- It also looks for files with the following in the name: mnemonic; recovery; privatekey; private_key; passphrase; backup; keystore; secret; 12word; 24word, wallet or phrase.
- Steals Discord tokens from Discord, PTB, Canary, Development and Lightcord.
- Steals Discord tokens and files from Vesktop; Legcord; Equicord; ArmCord; WebCord; Dorion; Abaddon; GoofCord; Spacebar; Vencord; BetterDiscord; Replugged, and OpenAsar.
- Steals from Telegram-related messaging services such as tdata; 64Gram; AyuGram; Kotatogram; Nekogram; Extragram; iMe, and Unigram.
- Steals gaming-related files for Steam; Roblox; Epic Games; Battle.net; Riot; Minecraft; GOG; Origin, and Ubisoft.
- Steals Outlook passwords from the registry and Mozilla Thunderbird profiles.
- Steals saved information from file transfer programs, including: FileZilla; WinSCP; CoreFTP; FlashFXP, and SmartFTP.
- Steals information from OpenVPN; NordVPN; ProtonVPN; PIA; Surfshark, and Windscribe.
- Steals from password managers, including: KeePass config; Bitwarden; 1Password; Dashlane; RoboForm; NordPass, and Sticky Password.
- It also records which security products are installed on a machine.
Aoki collects the available data from victim machines and sends it to its C&C server, using a /gate endpoint. Most of the newer samples used one domain, while two newer samples used a domain of their own. Older samples used an IP address and port 8080 over unencrypted HTTP.
Why AI credentials are valuable
API keys and Open Authorization (OAuth) or session tokens allow malicious activity to be carried out under a legitimate developer’s identity and API quota. They can also expose connected repositories, cloud services and CI/CD pipelines linked to that account, and may bypass safeguards that assume requests originate from a trusted user.
The malware stole credential, token and session files rather than source code. The exception is the local state database used by Cursor, which can cache chat context and code snippets.
A little-documented family
The name of this infostealer comes from a longer name (Aokigahara) in a string used by the malware during its decryption process. While there has been some limited publication about this malware, its functionality has not been extensively documented, and its targeting of AI assistants is a new development that hasn’t previously been reported. We do not know what threat group may be behind this malware and there are no indications that it has links to any existing malware family.
Aokigahara is the name of a very famous forest in Japan, but it’s not clear if that provides any clues as to the origins of the malware’s developers.
Significance
While payment card data and cryptocurrency wallets have long been a mainstay for information stealing malware, this development suggests AI credentials may be considered just as valuable for attackers. Like card data, a stolen AI key can be cashed in directly, either through resale or by running up usage on the victim’s account, a practice sometimes called LLMjacking. Unlike card data, it can also give an attacker a route into the developer’s wider environment.
The rest of Aoki’s target list points to a financial motive, with a strong focus on cryptocurrency-related wallets and extensions. The attackers are also clearly interested in credentials and accessing information about victims from the likes of Telegram and Discord sessions, which could potentially also give them access to other victims in the form of the victims’ contacts.
Aoki is a highly-capable and multi-functional infostealer whose capabilities still appear to be in active development.
Protection
If an IOC is malicious and the file is available to us, Symantec Endpoint products will detect and block that file. Symantec detects this family as Infostealer.Aoki.
Indicators of Compromise
File indicators
752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69 – Infostealer.Aoki
bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf – Infostealer.Aoki
0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3 – Infostealer.Aoki
6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999 – Infostealer.Aoki
780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519 – Infostealer.Aoki
2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94 – Infostealer.Aoki
73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896 – Infostealer.Aoki
07bc2e3a1d14743cc44f1dc4c78d15d0f2b458b39fb48422b13df40fc662ba21 – Infostealer.Aoki
c533570fd7cd7eaf5478317b03ea5750d03797aa4d11ebd96555b6cb708c63f2 – Infostealer.Aoki
6350dfee6975a9b159c5a57a3e97f757b0b02fd2dc708016fa6d7270e720c865 – Infostealer.Aoki
36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b – Infostealer.Aoki
039240551f88b0064b2615dffdc1321b1e7c58e3f617ac138a65a6d59400b331 – Infostealer.Aoki
0e38bd3c30a4ca08641240ce95b5b6ba593e131213ca1b2a28da4e0385fcabc4 – Infostealer.Aoki
3b4547f0d7549274f366cd9568b3d302c1e80e1b89359da681beb47260ec7975 – Infostealer.Aoki
b590235493487c51f7050b341c9b2450e4f761ad6055207e4f6daf0cecae271c – Infostealer.Aoki
e374f9ff5094f728528efa566c3de1b7fea7d95f497242a01fffa6c70b5eb768 – Infostealer.Aoki
f779314b1a5a0b297fd4e2a5f9c1e40d387b3e7c401d42324b556a70f813840e – Infostealer.Aoki
Network IOCs
dobeqnesmot[.]cc
hjazfioe[.]surf
neihite[.]cc
hxxps://dobeqnesmot[.]cc/gate
hxxps://hjazfioe[.]surf/gate
hxxps://neihite[.]cc/gate
Leave a Reply