SYMANTEC and the Carbon Black Threat Hunter Team report that newer builds of the Aoki infostealer, also known as Aokigahara, target credentials and configuration files used by AI coding tools. The Windows malware searches for local files and tokens associated with services including Claude, OpenAI Codex, Cursor, Codeium, Google Gemini, GitHub Copilot, JetBrains AI Assistant, Kiro and Amazon Web Services. The researchers analysed 17 malicious file samples, but the number of victims is not known. They have not attributed the malware to a known threat group, and say they found no links to an existing malware family.
Aoki also steals data from 41 web browsers, 67 browser wallet extensions and 21 desktop cryptocurrency applications, as well as seven password managers, six VPN clients and five FTP tools. It can collect Telegram and Discord sessions and enumerate installed security software. Although it does not have a backdoor command list, it packages files from the infected device and sends them to a command server. Older builds used unencrypted HTTP on port 8080; newer samples use HTTPS. The initial infection method remains unspecified.
The researchers warn that stolen AI credentials could be resold or used to run up charges on victims’ accounts, and that access to connected cloud services may create further risk. Their recommended response for potentially affected developers is to revoke exposed API keys, replace OAuth tokens, rotate AWS credentials and check cloud billing records for unauthorised use. Defenders should also use behavioural endpoint controls to block suspicious executables and monitor connections to untrusted domains.