Hackers Target Claude, ChatGPT and Cursor Credentials Using Aoki Infostealer

The Aoki infostealer, also known as Aokigahara, has expanded its collection capabilities to steal credentials and session files from AI coding assistants, putting developer identities and connected infrastructure at risk.

First observed earlier in 2026, Aoki previously lacked collection routines for AI applications.

Their appearance in recent samples indicates active development, with attackers broadening their targets to include authentication material stored by increasingly popular development tools.

The findings concern credentials harvested from compromised endpoints, rather than a reported breach of the AI providers themselves.

The newest analyzed variant targets .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files.

Researchers also identified theft of tokens associated with GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, together with Amazon Web Services credentials. These artifacts extend the potential impact beyond individual chatbot accounts.

Stolen API keys, OAuth tokens and session tokens can enable attackers to operate under a legitimate developer’s identity and consume the victim’s API quota.

Depending on permissions and integrations, compromised authentication material could also expose repositories, cloud services and continuous integration and continuous delivery pipelines.

Symantec’s Threat Hunter Team identified newer variants, targeting Claude, ChatGPT, OpenAI Codex, Cursor, Codeium, and Gemini alongside conventional browser and cryptocurrency data.

Aoki Infostealer Targets AI

Controls that trust authenticated requests may consequently provide insufficient protection against credential reuse.

The immediate opportunity includes unauthorized AI consumption, commonly called LLMjacking, or resale of access. However, researchers have not established downstream exploitation in this campaign.

Symantec also said it lacked visibility into the number of affected victims, making the distinction between demonstrated collection capabilities and confirmed operational consequences important.

Aoki retains an extensive collection scope covering browser cookies, autofill records, payment information, browsing history and Google tokens.

Targets span Chromium and Firefox families, cryptocurrency browser extensions, desktop wallets, messaging platforms, gaming clients, email applications, VPN software, FTP clients and password managers. It also identifies installed security products.

Wallet collection includes searches for filenames containing terms such as mnemonic, recovery, private_key, passphrase, keystore and 24word.

Messaging targets include Discord variants and Telegram clients, while additional routines retrieve Outlook passwords from the registry and Thunderbird profiles. Together, these capabilities expose both financial assets and reusable account access.

According to the supplied research details, Aoki primarily steals credentials, tokens and session files rather than source code.

Cursor’s local state database is an exception because it can contain cached conversation context and code snippets, potentially bringing development content into the stolen dataset.

Aoki has no backdoor command list. Instead, it gathers available information and sends it to command infrastructure through a /gate endpoint.

Most newer samples shared one domain, while two used separate domains; older variants transmitted over unencrypted HTTP to an IP address on port 8080.

Earlier public coverage appeared in CYFIRMA’s August 28 intelligence report, which documented Windows execution and network activity.

Symantec has not attributed Aoki to a known threat group or established links to another malware family.

Its expanding collection scope highlights developer authentication stores as valuable targets, while leaving the operators, distribution scale and subsequent use of stolen credentials unresolved in the available published reporting.

Indicators of Compromise

SHA-256 Hash	Detection
752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69	Infostealer.Aoki
bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf	Infostealer.Aoki
0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3	Infostealer.Aoki
6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999	Infostealer.Aoki

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.