Aoki Infostealer Now Grabs AI Coding Tokens From Developer Machines

The Aoki infostealer, also known as Aokigahara, has updated its code to harvest credentials and session files from AI coding assistants. This expansion puts developer identities and connected infrastructure at risk by targeting authentication material stored by popular development tools. The malware previously lacked these specific collection routines, indicating active development by the threat actors behind the campaign.

Which AI tools are being targeted?

Symantec’s Threat Hunter Team identified newer variants of Aoki targeting Claude, ChatGPT, OpenAI Codex, Cursor, Codeium, and Gemini. These tools are targeted alongside conventional browser data and cryptocurrency information. The malware specifically looks for OAuth tokens, API keys, and session tokens that allow access to these services without re-authentication.

What is the potential impact?

Stolen credentials can enable attackers to operate under a legitimate developer’s identity. This could lead to unauthorized AI consumption, often called LLMjacking, or the resale of access. Depending on permissions and integrations, compromised authentication material might also expose repositories, cloud services, and continuous integration pipelines. The findings concern credentials harvested from compromised endpoints, not breaches of the AI providers themselves.

Has this been exploited in the wild?

Researchers have not established downstream exploitation in this specific campaign. Symantec stated they lacked visibility into the number of affected victims. This makes the distinction between demonstrated collection capabilities and confirmed operational consequences important. The appearance of these routines in recent samples indicates attackers are broadening their targets, but confirmed abuse remains unverified.

What else does Aoki steal?

Beyond AI tools, Aoki targets Chromium and Firefox browsers, cryptocurrency extensions, desktop wallets, and messaging platforms. It searches for filenames containing terms like mnemonic, recovery, private_key, and keystore. The malware also retrieves Outlook passwords from the registry and Thunderbird profiles. It identifies installed security products and targets VPN software, FTP clients, and password managers.

What analysts watch for

Teams usually examine endpoint logs for unusual file access patterns in directories associated with development tools and browsers. Analysts check whether processes are reading sensitive configuration files or token stores outside of normal application behavior. They look for network connections to known command-and-control infrastructure shortly after credential access events. Monitoring for unexpected API usage spikes can also indicate compromised tokens.

What to do and how to stay safe: Aoki

• Rotate API keys and session tokens for all AI coding assistants and development tools immediately if you suspect compromise.
• Review active sessions and revoke unused access tokens in the security settings of your AI and cloud service accounts.
• Monitor API usage logs for unusual consumption patterns or requests originating from unexpected geographic locations or IP addresses.
• Ensure endpoint detection and response solutions are updated to identify known Aoki indicators of compromise and suspicious file access.

Step-by-step guide: Build an Incident Response Plan That Actually Works

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does Aoki target GitHub Copilot?

Yes, researchers identified theft of tokens associated with GitHub Copilot, along with Cursor, Google Gemini, JetBrains AI Assistant, and Kiro.

Did the AI providers suffer a data breach?

No, the findings concern credentials harvested from compromised endpoints rather than a reported breach of the AI providers themselves.

Can stolen tokens access cloud services?

Compromised authentication material could expose repositories, cloud services, and CI/CD pipelines depending on the permissions and integrations configured.