Aoki Malware Expands Targets to AI Tool Credentials, Raising Risks for Developers
A new variant of the Aoki (Aokigahara) malware, an information stealer, has broadened its scope to target credentials and session data from popular AI tools, including ChatGPT, Claude, OpenAI Codex, Cursor, Codeium, and Google Gemini. Researchers from Symantec’s Threat Hunter team identified the updated malware, which now searches for local files such as .claude.json, Claude desktop cookies, ChatGPT cookies, and configuration files like Codex config.toml and .env.
Unlike vulnerabilities in AI services themselves, Aoki focuses on locally stored data on infected devices. Stolen tokens or keys could allow attackers to impersonate users, incur paid usage charges, or access connected services, including cloud accounts, repositories, and CI/CD pipelines. Earlier versions of Aoki did not target AI-related files, indicating this is a recent evolution in its data-collection tactics.
Beyond AI tools, Aoki continues to harvest a wide range of sensitive data, including:
- Browser data: Cookies, saved passwords, autofill details, credit card information, and Google tokens.
- Cryptocurrency wallets: Files and extensions from popular wallets.
- Messaging apps: Telegram and Discord session data.
- Security tools: Records of installed security products.
- Other applications: VPNs, password managers, gaming services, and file-transfer tools.
The malware exfiltrates stolen data to a command-and-control (C2) server via a /gate endpoint, with newer samples using multiple domains (e.g., dobeqnesmot[.]cc, hjazfioe[.]surf) instead of older IP-based connections over unencrypted HTTP. Symantec classifies the threat as Infostealer.Aoki, though its origins remain unlinked to a known threat group.
The shift toward AI credentials aligns with a broader trend of LLMjacking, where attackers abuse stolen accounts to run paid AI models at the victim’s expense. While Aoki’s primary focus is local data theft, compromised AI tokens could expose developers to secondary risks, including unauthorized access to source code repositories and cloud services.
Symantec’s report includes indicators of compromise (IoCs), such as file hashes and C2 domains, to aid detection efforts. The malware’s expanded targeting underscores the need for developers to treat local AI configuration files and session data as sensitive assets, similar to cloud keys and source-control credentials.
Source: https://cybersecuritynews.com/new-aoki-malware/
Cursor TPRM report: https://www.rankiteo.com/company/anysphereinc
OpenAI TPRM report: https://www.rankiteo.com/company/openai
Anthropic TPRM report: https://www.rankiteo.com/company/anthropicresearch
Codeium TPRM report: https://www.rankiteo.com/company/codeium
"id": "codopeanyant1792154582",
"linkid": "codeium, openai, anysphereinc, anthropicresearch",
"type": "Cyber Attack",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Technology, Software Development',
'type': 'Developers, AI tool users'}],
'attack_vector': 'Malware (Aoki variant)',
'data_breach': {'data_exfiltration': 'Exfiltrated to C2 server via /gate '
'endpoint',
'file_types_exposed': ['.claude.json',
'Claude desktop cookies',
'ChatGPT cookies',
'Codex config.toml',
'.env'],
'personally_identifiable_information': 'Yes (browser autofill '
'details, saved '
'passwords, Google '
'tokens)',
'sensitivity_of_data': 'High (personally identifiable '
'information, financial data, '
'authentication tokens)',
'type_of_data_compromised': ['AI tool credentials',
'Session data',
'Browser data',
'Cryptocurrency wallets',
'Messaging app data',
'Security tool records',
'VPN data',
'Password manager data',
'Gaming service data',
'File-transfer tool data']},
'description': 'A new variant of the Aoki (Aokigahara) malware, an '
'information stealer, has broadened its scope to target '
'credentials and session data from popular AI tools, including '
'ChatGPT, Claude, OpenAI Codex, Cursor, Codeium, and Google '
'Gemini. The malware searches for locally stored files such as '
'.claude.json, Claude desktop cookies, ChatGPT cookies, and '
'configuration files like Codex config.toml and .env. Stolen '
'tokens or keys could allow attackers to impersonate users, '
'incur paid usage charges, or access connected services, '
'including cloud accounts, repositories, and CI/CD pipelines.',
'impact': {'data_compromised': 'AI tool credentials, session data, browser '
'data, cryptocurrency wallets, messaging app '
'data, security tool records, VPNs, password '
'managers, gaming services, and file-transfer '
'tools',
'financial_loss': 'Potential paid usage charges for AI services',
'identity_theft_risk': 'High (stolen credentials and session data)',
'operational_impact': 'Unauthorized access to cloud accounts, '
'repositories, and CI/CD pipelines',
'payment_information_risk': 'High (credit card information, '
'cryptocurrency wallets)',
'systems_affected': 'Infected devices with locally stored AI tool '
'credentials and other sensitive data'},
'investigation_status': 'Ongoing (IoCs provided by Symantec)',
'lessons_learned': 'Developers should treat local AI configuration files and '
'session data as sensitive assets, similar to cloud keys '
'and source-control credentials.',
'motivation': 'Data theft, financial gain, unauthorized access',
'post_incident_analysis': {'corrective_actions': 'Secure local AI '
'configuration files, '
'enhance detection for '
'malware targeting '
'credentials, and monitor '
'for unauthorized access to '
'AI services.',
'root_causes': 'Evolution of Aoki malware to '
'target locally stored AI tool '
'credentials and session data'},
'recommendations': 'Enhance monitoring for malware like Aoki, secure locally '
'stored credentials, and treat AI tool session data with '
'the same security rigor as other sensitive assets.',
'references': [{'source': 'Symantec’s Threat Hunter team'}],
'response': {'third_party_assistance': 'Symantec’s Threat Hunter team'},
'title': 'Aoki Malware Expands Targets to AI Tool Credentials',
'type': 'Information Stealer'}