Aokigahara malware targets AI developer credentials and session data

Check Point Research describes Aokigahara as a newly observed infostealer found in the wild.[2] It says an earlier version of the malware may have been known as Kamidere or Stygian.[2] Symantec says older samples did not search for AI-related files, which it says indicates that this capability was added recently.[3] Symantec also says it does not know which threat group is behind Aoki and has no indication that the malware is linked to an existing family.[3] Those findings distinguish what researchers have observed from what remains unknown about the malware’s origins.

The AI-related targets named by Check Point Research include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf and GitHub Copilot.[2] Its list also includes Gemini CLI and JetBrains AI Assistant.[2] The research says the malware seeks authentication files, session data and configuration files associated with AI applications and development tools.[2] Check Point Research specifically identifies Claude’s credentials.json and Codex’s auth.json files as targets.[1] Symantec says Aoki collects available data from victim machines and sends it to its command-and-control server.[3]

Check Point Research says the collection routines also target AWS credentials and single sign-on data.[2] A separate malware handler collects Git credentials, SSH files that may contain private keys, and cloud configuration data, according to the Cyber Press report.[1] Check Point Research says the malware also targets browser credentials and cookies, cryptocurrency wallet data, screenshots and clipboard contents.[2] It identifies password managers, VPN clients, FTP/SFTP clients and email applications as additional targets.[2] Stolen developer secrets could provide access to repositories, cloud resources and other development services, Check Point Research says.[1]

Check Point Research says valid AI sessions could expose private conversations, uploaded files or proprietary source code.[1] Symantec says stolen API keys and tokens could let attackers act under a legitimate developer’s identity and API quota, and could expose connected repositories, cloud services and CI/CD pipelines.[3] However, Check Point Research cautions that targeted files may contain tokens, credentials or session data, but not every file necessarily contains authentication secrets.[2] It says the malware can use optional checks to identify analysis environments, including debugger, virtual-machine and sandbox checks.[2] Check Point Research says stolen credentials could potentially enable unauthorized use of paid AI services or resale of compromised accounts, but it has not confirmed operator monetization.[4]