New Aoki Infostealer Targets AI Coding Assistant Credentials
Symantec says the Aoki infostealer now steals API keys and sessions from AI coding assistants.
Symantec's Threat Hunter Team says newer builds of the Aoki infostealer steal credentials and session files from AI coding assistants, expanding beyond browser, cryptocurrency-wallet, and password-manager theft. Targeted files include .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files, plus tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant, and Kiro, and AWS credentials. Stolen keys can support LLMjacking and expose linked repositories, cloud services, and CI/CD pipelines. Aoki was first observed in 2026; Symantec has not tied it to a known group and assesses the operators as financially motivated.
- Aoki now steals Claude, Codex, Cursor, Gemini, and Copilot tokens.
- It also collects AWS credentials plus crypto-wallet data.
- Stolen keys can enable LLMjacking and reach cloud and CI/CD.
- First observed in 2026, with no link to a known family.
- Symantec assesses the operators as financially motivated.
Full article385 words · extracted from infosecurity-magazine.com · click to collapse
New versions of the Aoki infostealer are targeting credential and session files used by popular AI coding assistants, a new report by Symantec has warned.
This represents a significant development from to earlier versions of Aoki, which focused on browser, cryptocurrency wallet and password manager data, and did not target AI-related files.
Now, the stealer is also able to access API keys and tokens from a number of AI coding assistants, including Anthropic’s Claude, OpenAI's Codex, SpaceX’s Cursor and Google’s Gemini.
The Symantec researchers said that this information can allow a threat actor to carry out malicious activity under a legitimate developer's identity and API quota, bypassing safeguards that assume requests originate from a trusted user.
In addition, the tokens can expose connected repositories, cloud services and continuous integration and continuous delivery (CI/CD) pipelines linked to that account.
Aoki Targets ChatGPT, Claude and GitHub Copilot Credentials
The report, published on October 15, noted that Aoki is a relatively new and sparsely documented infostealer, first observed earlier in 2026.
The ability to steal AI-related files is recent and appears to be expanding, the researchers noted. The newest version of the stealer found by the Symantec’s Threat Hunter Team targeted .claude.json, Claude desktop cookies, ChatGPT cookies, and the Codex config.toml and .env files.
In addition, it stole tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, along with Amazon Web Services (AWS) credentials.
“Aoki is a highly capable and multi-functional infostealer whose capabilities still appear to be in active development,” Symantec added.
AI Credentials Increasingly Valuable to Hackers
The researchers said Aoki’s development suggests that AI credentials are now considered just as valuable as payment card data and cryptocurrency wallets by threat actors.
“Like card data, a stolen AI key can be cashed in directly, either through resale or by running up usage on the victim's account, a practice sometimes called LLMjacking. Unlike card data, it can also give an attacker a route into the developer's wider environment,” they explained.
Symantec emphasized that it does not know which threat group may be behind the Aoki infostealer and there are no indications it has links to any existing malware family.
However, the rest of the stealer’s target list, which includes a focus on cryptocurrency related wallets and extensions, indicates that the attackers are financially-motivated.