Aoki infostealer adds AI assistant credentials to its targets

Symantec says it first saw Aoki earlier in 2026.[1] Older samples did not search for AI-related files, while newer versions were built to harvest credential and session files associated with Claude, OpenAI Codex, Cursor, Codeium and Gemini.[1] Symantec describes the theft of AI-assistant credentials as a recent addition to Aoki’s capabilities, rather than a feature seen in older samples.[1] That change makes the specific assistant and account types an important part of reviewing exposure.[1]

Symantec says its newest analyzed sample targeted Claude and ChatGPT cookies, Claude’s.claude.json file, and Codex configuration and environment files.[1] It also stole tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, along with AWS credentials.[1] The products and file types differ, so teams should not assume every listed assistant is targeted in the same way.[1] The evidence describes what this sample targeted; it does not establish that every version of Aoki targets every item on the list.[1]

Symantec says Aoki takes credential, token and session files rather than source code, with Cursor’s local state database as an exception.[2] That database can cache chat context and code snippets.[2] Stolen tokens can expose repositories, cloud services and CI/CD pipelines connected to an account, and credentials may bypass safeguards that assume requests come from a trusted user.[2] Symantec says attackers may resell a stolen AI key or run up usage on the victim’s account, a practice called LLMjacking.[2]

Symantec says the newest analyzed sample also stole data from dozens of browsers, cryptocurrency wallets, password managers, messaging and gaming apps, and VPN and FTP clients.[2] Aoki collects available data from infected machines and sends it to a command-and-control server through a /gate endpoint; Symantec says it has no backdoor command list.[2] Symantec does not know which threat group is behind Aoki and has found no indication of a link to an existing malware family.[2] The company says Aoki’s focus on cryptocurrency wallets and extensions points to a financial motive.[2]

Symantec says its Endpoint products detect the Aoki family as Infostealer.Aoki when a malicious file is available to the company.[2] That condition matters when planning a response: Symantec’s statement does not say that every infection will be identified.[2] Treat the detection information as one input to endpoint review, and consider checking exposed credentials and connected services as part of response planning.[2]