Aokigahara infostealer collects AI coding-tool tokens and cloud credentials
Original title: New Malware Targets AI Coding Tools to Steal Login Tokens, SSH Keys, and Cloud Credentials
Check Point says it searches local app storage rather than exploiting a flaw in the targeted AI assistants.
Check Point Research documented an infostealer called Aokigahara that targets AI coding assistants, developer workstations, and cloud credentials. It collects authentication and configuration files from tools including Claude, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, and also queries Windows Credential Manager. A separate handler looks for Git credentials, SSH material, and AWS, Azure, and Google Cloud files. Symantec tracks the same malware as Aoki, also known as Aokigahara, and says AI credential collection appeared in newer versions.
Unconfirmed: Check Point does not establish monetization or confirm that every collected session remains valid; targeted clipboard wallet formats are unconfirmed.
- Targets also include ChatGPT Desktop, Amazon Q, Kiro, JetBrains AI Assistant, and Visual Studio Code.
- Exfiltration uses /gate/handshake, /gate/chunk, and /gate/complete with X25519 and AES-256-GCM.
- Configuration is stored encrypted in the .stgcfg section and decrypted with AES-256-CBC.
- Earlier versions may have circulated as Kamidere or Stygian.
- Recent samples use the User-Agent Microsoft-CryptoAPI/10.0.
Impact: Theft of AI sessions, SSH keys, and cloud credentials
- 1.Hunt for the published Aokigahara SHA1 hashes on developer workstations.
- 2.Review AI assistant, SSH, Git, and cloud credential files on machines that may have run it.
- ATT&CK
- T1552.001 Credentials In FilesT1555.004 Windows Credential ManagerT1115 Clipboard DataT1041 Exfiltration Over C2 Channel
- Organizations
- Check Point ResearchSymantec Threat Hunter Team
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 007137599bc4d69ee952a5228b5fcb2c3b9a95a7 | and configuration changes. IOCs Type Value Aokigahara SHA1 007137599bc4d69ee952a5228b5fcb2c3b9a95a7 Aokigahara SHA1 00d52c7e759d878f0d8a117502f6d854af13f007 Ao |
| sha1 | 00d52c7e759d878f0d8a117502f6d854af13f007 | A1 007137599bc4d69ee952a5228b5fcb2c3b9a95a7 Aokigahara SHA1 00d52c7e759d878f0d8a117502f6d854af13f007 Aokigahara SHA1 04eddccb79db41e03a4ee8542e8a33d7f1d9fe18 Ao |
| sha1 | 04eddccb79db41e03a4ee8542e8a33d7f1d9fe18 | A1 00d52c7e759d878f0d8a117502f6d854af13f007 Aokigahara SHA1 04eddccb79db41e03a4ee8542e8a33d7f1d9fe18 Aokigahara SHA1 057a2d1dedeb93b7765c455a9e0c469e7cbe4843 Ao |
| sha1 | 057a2d1dedeb93b7765c455a9e0c469e7cbe4843 | A1 04eddccb79db41e03a4ee8542e8a33d7f1d9fe18 Aokigahara SHA1 057a2d1dedeb93b7765c455a9e0c469e7cbe4843 Aokigahara SHA1 079ddf5cc7d6ca2e02f860f87d4d18c83db9d331 Ao |
| sha1 | 079ddf5cc7d6ca2e02f860f87d4d18c83db9d331 | A1 057a2d1dedeb93b7765c455a9e0c469e7cbe4843 Aokigahara SHA1 079ddf5cc7d6ca2e02f860f87d4d18c83db9d331 Aokigahara SHA1 0b74ce90a39278fb97fe94f6306af71cbe679503 Ao |
| sha1 | 0b74ce90a39278fb97fe94f6306af71cbe679503 | A1 079ddf5cc7d6ca2e02f860f87d4d18c83db9d331 Aokigahara SHA1 0b74ce90a39278fb97fe94f6306af71cbe679503 Aokigahara SHA1 0c46ac5555cf8f305c1345a21d0802c52bf52cd8 No |
| sha1 | 0c46ac5555cf8f305c1345a21d0802c52bf52cd8 | A1 0b74ce90a39278fb97fe94f6306af71cbe679503 Aokigahara SHA1 0c46ac5555cf8f305c1345a21d0802c52bf52cd8 Note: IP addresses and domains are intentionally defanged ( |
From the original article
3 min read at gbhackers.com
A newly observed infostealer called Aokigahara is targeting AI coding assistants, developer workstations, and cloud credentials, expanding credential theft beyond browsers and cryptocurrency wallets. The targets include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.