Aoki infostealer now steals AI assistant credentials

Symantec says newer Aoki builds steal AI coding-assistant tokens and sessions, raising LLMjacking and cloud-access risks.

Symantec's Threat Hunter Team says newer builds of the Aoki infostealer, also known as Aokigahara and detected as Infostealer.Aoki, now steal credentials and session files from AI coding assistants in addition to browser data, cryptocurrency wallets, and password-manager secrets. Targeted material includes .claude.json, Claude and ChatGPT cookies, Codex config.toml and .env files, Cursor's local state database, tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant, and Kiro, and AWS credentials. Later reports say the malware also collects payment data, messaging, email, VPN data, and Telegram and Discord information before sending stolen material to a /gate command-and-control endpoint; the earliest report does not state those details. Stolen keys could enable LLMjacking and expose linked repositories, cloud services, and CI/CD pipelines, and Cursor's local database may hold cached chat context and code snippets. One report adds that stolen tokens can be reused even when multi-factor authentication is enabled. All three describe theft from compromised endpoints rather than a provider breach. Aoki was first observed in 2026; Symantec has not named a group—the first report says it is not linked to a known family—and assesses the operators as financially motivated, while researchers have not confirmed downstream misuse or how many victims are affected. Defenders are advised to revoke AI sessions and rotate exposed keys from a clean device.

• Symantec's Threat Hunter Team says newer Aoki builds, also called Aokigahara and detected as Infostealer.Aoki, steal local AI-assistant credentials and sessions from infected developer machines.
• Named targets include .claude.json, Claude and ChatGPT cookies, Codex config.toml and .env files, Cursor's local state database, and tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant, and Kiro, plus AWS credentials.
• Aoki still collects browser cookies and passwords, payment data, cryptocurrency wallets, password-manager secrets, messaging, email, VPN data, and Telegram and Discord information, then sends it to a /gate command-and-control endpoint.
• This concerns credentials taken from compromised endpoints, not a breach of the AI providers; stolen keys could support LLMjacking and access to repositories, cloud services, and CI/CD, and one report says tokens can be reused even with…
• Aoki was first observed in 2026. Symantec has not named a threat group and assesses the operators as financially motivated; researchers have not confirmed downstream misuse or a victim count.
• Defenders are advised to revoke AI sessions and rotate exposed keys from a clean device.