NEW versions of the Aoki infostealer are targeting credential and session files used by popular AI coding assistants, according to a Symantec report. The latest development marks a shift from earlier Aoki variants, which focused on browser data, cryptocurrency wallets and password managers, to now grabbing AI-related files and credentials.
The researchers say the stealer can access API keys and tokens from several AI coding assistants, including Anthropic’s Claude, OpenAI’s Codex, SpaceX’s Cursor and Google’s Gemini, enabling an attacker to operate under a legitimate developer’s identity and API quota and potentially bypass safeguards that assume trusted-user requests. The stolen tokens can also expose connected repositories, cloud services and CI/CD pipelines linked to the compromised accounts.
The report, published on 15 October, notes that Aoki is a relatively new infostealer first observed earlier in 2026 and that its focus on AI credentials is expanding. The newest observed version targeted files such as .claude[.]json, Claude desktop cookies, ChatGPT cookies, and Codex configuration files like config[.]toml and .env. It also stole tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, along with AWS credentials.
Symantec describes Aoki as highly capable and still under active development, suggesting AI credentials have become as valuable to threat actors as payment card data or cryptocurrency wallets, potentially enabling direct monetisation or expansion into a victim’s broader environment.