An established information-stealing malware family known as Aoki — sometimes labeled Aokigahara after a string used in its decryption routine — has expanded its target list to include the local files and session data belonging to AI coding assistants, including ChatGPT, Claude, OpenAI Codex, Cursor, Codeium, and Google Gemini. The addition, identified by Symantec’s Threat Hunter team, signals a broader shift in what infostealer operators now consider valuable loot sitting on a developer’s laptop.

A Familiar Threat, Updated Targeting

Aoki is not a new strain — it has circulated for some time as a general-purpose credential and data thief. What’s changed is its collection list. Symantec’s analysis found that recent builds actively search for files tied to Claude, ChatGPT, and Codex, along with authentication tokens used by GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant, and Kiro. Earlier Aoki samples didn’t bother with any of this, which suggests the AI-tooling targeting is a deliberate, relatively recent addition to the malware’s capabilities rather than a longstanding feature.

Specific files named in Symantec’s report include the .claude.json configuration file, locally stored Claude desktop and ChatGPT session cookies, and Codex’s config.toml and .env files — exactly the kind of files that routinely hold live session tokens, API keys, or account secrets. Aoki also reaches into Cursor’s local state database, which can retain chat history and code snippets, though Symantec notes the malware’s apparent priority is grabbing credentials and session data rather than harvesting source code for its own sake.

Why a Stolen AI Token Matters

Unlike a vulnerability in an AI vendor’s cloud service, this is squarely a device-compromise problem: Aoki only works if it’s already running on an infected machine. But the consequences of a successful theft extend well past the AI subscription itself. A stolen session token or API key can let an attacker operate as the account’s legitimate owner — running up paid usage charges, or, more worryingly for development teams, potentially reaching any repositories, cloud services, or CI/CD pipelines that the AI tool had legitimate access to.

This isn’t an isolated concern. Compromised cloud credentials have already been observed fueling a scheme known as LLMjacking, in which stolen access is used to run paid AI workloads at someone else’s expense. Aoki’s reported behavior is distinct — it steals data directly from the device rather than cloud keys specifically — but the underlying risk to victims is the same: someone else quietly operating under your account and your bill.

AI Tools Are Just One Target Among Many

Aoki’s reach goes far beyond developer tools. Symantec’s report describes it harvesting browser cookies, saved passwords, autofill data, and stored payment card details across a wide range of browsers, alongside cryptocurrency wallet files and extensions, password manager data, VPN and file-transfer application credentials, gaming account details, and data from Telegram and Discord. It also fingerprints which security products are installed on the infected machine — reconnaissance that can inform follow-on attacks or help the operator evade detection.

That breadth is what makes a single infection consequential: one compromised laptop can become a pivot point into a developer’s cloud accounts, source control, messaging platforms, and financial tools all at once. Stolen data is sent to attacker-controlled infrastructure through a /gate endpoint; Symantec notes that newer samples spread requests across multiple domains, while older variants relied on a single IP address communicating over unencrypted HTTP on port 8080.

Symantec has not tied Aoki to a specific named threat actor or an established malware family, and the report doesn’t offer insight into its distribution method. The company tracks the family internally as Infostealer.Aoki.

What Development Teams Should Do

• Treat AI assistant configuration files, session cookies, and local state databases with the same sensitivity as cloud API keys or source-control credentials — because they now function the same way to an attacker.
• If compromise is suspected, use a known-clean device to revoke active AI tool sessions, rotate exposed API keys, and review recent account activity for unauthorized usage.
• Audit connected repositories, cloud services, and CI/CD systems for unexpected access tied to AI tool accounts following any suspected infection.
• Avoid storing long-lived secrets in files local applications can read freely, and scope tokens to the minimum access and lifetime actually needed.
• Monitor endpoints for unusual access to AI tool configuration folders and unexpected outbound connections, which may indicate stealer activity even before other symptoms appear.

Security teams should note that multi-factor authentication offers limited protection here — if a session token has already been lifted from a compromised device, an attacker can often reuse it without ever needing to pass an MFA challenge. Aoki’s pivot toward AI tooling fits a wider pattern researchers have flagged recently, including fake npm packages impersonating AI tools specifically to harvest credentials from developer machines, underscoring that the rapid adoption of AI coding assistants has made local developer environments a genuinely attractive target rather than an overlooked one.