A newly observed infostealer called Aokigahara is targeting AI coding assistants, developer workstations, and cloud credentials, expanding credential theft beyond browsers and cryptocurrency wallets.
The targets include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant.
Rather than exploiting an identified vulnerability in these products, the malware searches local application storage for potentially valuable files. However, not every targeted configuration file necessarily contains usable authentication secrets.
Aokigahara’s dedicated aisessions handler collects Codex authentication and configuration files, Claude credentials, Cursor and Windsurf state databases, and GitHub Copilot storage.
Its collection scope also covers Amazon Q, Kiro, AWS credentials, and AWS single sign-on caches. The routine additionally queries Windows Credential Manager, extending collection beyond ordinary files.
Usable tokens could let attackers access compromised AI accounts, consume paid services, or expose private conversations and development information. Reselling access represents another potential monetization route.
Check Point’s analysis, however, does not establish how the operators actually monetize stolen material or confirm that every collected session remains valid.
Related research from Symantec’s Threat Hunter Team tracks the malware as Aoki, also known as Aokigahara.
Its findings indicate that AI credential collection appeared in newer versions, connecting the latest analysis to an evolving theft capability rather than an entirely separate malware family.
Check Point Research documented the malware, in the wild and identified dedicated routines that collect authentication files, session data, and configuration files from widely used AI applications. Earlier versions may have circulated as Kamidere or Stygian.
A separate ide handler searches code editors and development environments, including Visual Studio Code, Cursor, Windsurf, and JetBrains products.
Targets include Git credential files, files under .ssh that may contain private keys, and AWS, Azure, and Google Cloud credential and configuration files. Matching contents pass to the malware’s upload routine.
This creates potential exposure beyond individual AI subscriptions. Valid stolen secrets could provide access to repositories, cloud resources, and connected development services.
The practical impact depends on credential validity, permissions, and whether collected files actually contain recoverable secrets.
Traditional capabilities remain extensive: browser password and cookie theft, screenshots, clipboard collection, cryptocurrency wallet harvesting, and theft from messaging, email, VPN, FTP, and password-management applications.
A separate dropped component handles clipboard manipulation; its targeted wallet formats remain unconfirmed.
The malware stores its encrypted configuration in the .stgcfg section and decrypts it using AES-256-CBC.
Configuration fields define command-and-control infrastructure, a server X25519 public key, module selection, certificate-pinning settings, and fallback URLs. Disabled modules remain embedded in the executable.
Exfiltration uses /gate/handshake, /gate/chunk, and /gate/complete. An X25519 exchange establishes shared key material, while SHA-256 derives the key used to encrypt collected ZIP archives with AES-256-GCM.
Upload headers identify collection modules and chunk sequence numbers.
The completion message marks the upload phase’s end, not independent confirmation that every transfer succeeded.
Optional anti-analysis checks inspect debugger indicators, virtualization artifacts, hardware resources, process counts, cursor movement, and suspicious account names.
Configurable language checks can also terminate execution. Together, these controls complicate automated analysis while allowing operators to select collection capabilities for individual builds.
Recent samples communicate using the Microsoft-CryptoAPI/10.0 User-Agent, reflecting continued development across analyzed versions and configuration changes.
IOCs
| Type | Value |
|---|---|
| Aokigahara SHA1 | 007137599bc4d69ee952a5228b5fcb2c3b9a95a7 |
| Aokigahara SHA1 | 00d52c7e759d878f0d8a117502f6d854af13f007 |
| Aokigahara SHA1 | 04eddccb79db41e03a4ee8542e8a33d7f1d9fe18 |
| Aokigahara SHA1 | 057a2d1dedeb93b7765c455a9e0c469e7cbe4843 |
| Aokigahara SHA1 | 079ddf5cc7d6ca2e02f860f87d4d18c83db9d331 |
| Aokigahara SHA1 | 0b74ce90a39278fb97fe94f6306af71cbe679503 |
| Aokigahara SHA1 | 0c46ac5555cf8f305c1345a21d0802c52bf52cd8 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
