Skip to content
NewA calmer, faster ZeroHour
Malwarehigh

Aokigahara infostealer targets browsers, cloud keys, and AI apps

Original title: Infostealer riding the AI Train

Check Point Research ()11 min read1 · 1 read
Read at research.checkpoint.com
Part of a story covered by 2 sourcesAokigahara infostealer targets AI sessions and cloud credentialsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Check Point says the stealer also grabs Claude, ChatGPT Desktop, Codex, Cursor, and cloud and Git credentials.

Check Point Research reports Aokigahara, a newly observed infostealer, in the wild; an earlier version may have been known as Kamidere or Stygian. It steals browser logins and cookies, wallet data, VPN, FTP, email, and password-manager material, plus screenshots and clipboard contents, and drops a separate clipper. Collection also covers AI desktop and developer tools and Git, SSH, AWS, Azure, and Google Cloud credential files. The report does not confirm how operators monetize what is stolen.

Unconfirmed: An earlier name of Kamidere or Stygian is described as possible, and monetization is not confirmed.

Key facts
  • AI targets named include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI.
  • Browser coverage includes many Chromium profiles plus Firefox logins decrypted through NSS.
  • Wallet targets include desktop wallets and extensions such as MetaMask, Phantom, and Trust.
  • A clipper handler drops a separate component for clipboard manipulation.
Security assessment · AI, from the article

Impact: Theft of credentials, sessions, wallets, and cloud and AI access files

What to do
  1. 1.Review local AI app, Git, SSH, and cloud credential files for theft by Aokigahara.
  2. 2.Rotate browser, wallet, VPN, email, and cloud credentials if this stealer is suspected.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1555.003 Credentials from Web BrowsersT1539 Steal Web Session CookieT1113 Screen CaptureT1115 Clipboard DataT1552.004 Private Keys
Tags
infostealeraokigaharacredential-theftcryptocurrencycloud-credentials
Products
ChatGPT DesktopCodexCursorWindsurfGitHub CopilotGemini CLI
Malware
AokigaharaKamidereStygian
Organizations
Check Point Research
AI models
ClaudeChatGPTGemini

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
md5ca47b44161834cb70a224dbe3d92a3839a1db8f55db8fa28807993651224a40800f67d31a7343f42 X-Session: ca47b44161834cb70a224dbe3d92a383 X-HWID: 69B506A1 X-KEX: x25519 Content-Length: 32 Host: $SE
sha256aa1512a895a0049e9a1db8f55db8fa28807993651224a40800f67d31a7343f42Microsoft-CryptoAPI/10.0 X-Build-ID: cae87a25 X-Gate-Token: aa1512a895a0049e9a1db8f55db8fa28807993651224a40800f67d31a7343f42 X-Session: ca47b44161834cb70a224dbe3d92a383 X-HWID: 69B506A
sha256fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8eca47b44161834cb70a224dbe3d92a383 X-Total: 19 X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e Content-Length: 3233 Host: $SERVER \x00\x00\x00\x00$RANDOM_

From the original article

11 min read at research.checkpoint.com

Key Points Introduction Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and development tools.

Check Point Research

research.checkpoint.com

Read the full article at Check Point Research

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.