Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Aokigahara infostealer targets AI sessions and cloud credentials

2 sources · 2 articlesFirst reported Updated ()1
What's new

October 23: Check Point named Aokigahara’s AI, wallet, and cloud targets and a separate clipper; these reports add no later findings.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Check Point says Aokigahara is in the wild, stealing AI sessions, browser data, wallets, and cloud credentials.

Check Point Research reports Aokigahara, a newly observed infostealer in the wild that may earlier have been known as Kamidere or Stygian. It steals browser logins and cookies, wallet data, VPN, FTP, email, and password-manager material, plus screenshots and clipboard contents, and drops a separate clipper. Collection also covers AI desktop and developer tools and Git, SSH, AWS, Azure, and Google Cloud credential files. The report does not confirm how operators monetize stolen data.

Key facts
  • An earlier version may have been known as Kamidere or Stygian.
  • AI targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI.
  • Browser theft covers Chromium profiles and Firefox logins decrypted through NSS.
  • Wallet targets include desktop wallets and MetaMask, Phantom, and Trust extensions.
  • A clipper handler drops a separate clipboard-manipulation component.
  • Check Point does not confirm how operators monetize stolen data.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Check Point ResearchNames Aokigahara, possible prior aliases, AI and cloud targets, and a clipper.
Products
ChatGPT DesktopCodexCursorWindsurfGitHub CopilotGemini CLIGoogle Gemini
Malware
AokigaharaKamidereStygian
Organizations
Check Point ResearchANY.RUN
Countries
United StatesIndia
AI models
ClaudeChatGPTGeminiMicrosoft Copilot

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Cyber Security NewsFirst report

    Fake AI apps steal credentials and plant malware, ANY.RUN says

    Researchers tied 1,258 public sandbox analyses from April 15 to October 5 to campaigns impersonating popular AI brands.

  2. · 2d ago Check Point Research

    Aokigahara infostealer targets browsers, cloud keys, and AI apps

    Check Point says the stealer also grabs Claude, ChatGPT Desktop, Codex, Cursor, and cloud and Git credentials.