Aokigahara stealer takes developer keyrings and AI assistant sessions
Original title: 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants
Check Point says the Windows malware also steals browser, VPN, wallet, and password-manager data from one endpoint.
Check Point Software describes Aokigahara, a Windows infostealer that collects data from browsers, VPN clients, cryptocurrency wallets, FTP clients, password managers, and email apps. It specifically gathers authentication files, session data, and configuration files from Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other AI tools. Check Point says those credentials can be reused, resold, or turned toward developer and cloud access.
Unconfirmed: The excerpt does not say how Aokigahara is delivered or how widely it is deployed.
- The malware is named after the forest at the base of Mount Fuji.
- Targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, Copilot, and Gemini CLI.
- Check Point says stolen AI sessions and accounts can be resold or abused.
- The report also links stolen developer secrets to enterprise and cloud risk.
Impact: Theft of credentials, sessions, and AI and developer configuration data
- ATT&CK
- T1555 Credentials from Password StoresT1552.001 Credentials In FilesT1539 Steal Web Session Cookie
- Malware
- Aokigahara
- Organizations
- Check Point Software
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0c2bf78193ce890be6758a839f600144 | new-ways-hack-vehicles#recipe=similar-items&sourcecontentid=0c2bf78193ce890be6758a839f600144) Swipe, Plug-in, Pwned: Researchers Find New Ways to Hack |
| md5 | 54a575f7d010b9cbd0c2156a54d34c1e | ini-ai-panel-hijacking#recipe=similar-items&sourcecontentid=54a575f7d010b9cbd0c2156a54d34c1e) Bug in Google's Gemini AI Panel Opens Door to Hijacking b |
| md5 | 67c8a9b903f24a7d2a6105fe1eba82b0 | linux-vms-hide-windows#recipe=similar-items&sourcecontentid=67c8a9b903f24a7d2a6105fe1eba82b0) Pro-Russian Hackers Use Linux VMs to Hide in Windows by A |
| md5 | ed4866a711b169c66777cf3a2a5a810d | t-exposed-llm-services#recipe=similar-items&sourcecontentid=ed4866a711b169c66777cf3a2a5a810d) 2 Separate Campaigns Probe Corporate LLMs for Secrets by |
From the original article
8 min read at darkreading.com
The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.
By Elizabeth Montalbano · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.