Threat intel

Aokigahara stealer targets AI and developer tool tokens

By Yaali. October 27, 2026, 6 min read, Threat intel, AI security, Windows.

A Windows infostealer reads the token files of Claude, Codex, Cursor, Copilot and AWS tools. What it takes, how it phones home and how to hunt and rotate.

Check Point Research published an analysis on October 23 of Aokigahara, a Windows infostealer with a module built to collect the local credential and session files of AI assistants and coding tools: Claude, Codex, ChatGPT Desktop, Cursor, GitHub Copilot, Gemini CLI and more. A second module takes Git credentials, SSH keys and AWS, Azure and Google Cloud configuration. Symantec's Threat Hunter Team had reported the same family on October 15 under the name Aoki, after the string "Aokigahara" that the malware uses during decryption.

If your developers sign in to AI tools or cloud command line interfaces on Windows, the files on this list sit in their profile folders right now. Those files hold tokens that work without a password or multi-factor authentication (MFA) prompt. Both vendors published indicators, and Check Point published a YARA rule, so you can hunt for it today. Neither report says how Aokigahara reaches victims, so delivery is unknown.

How it works

Aokigahara is built from modules, and a module_mask value in its encrypted configuration decides which ones run. Check Point notes that every module's code stays in the binary even when switched off, so a sample that skipped AI files can still match signatures for that code.

The AI targeting sits in a module named aisessions. It reads files such as .claude.json and the Claude credentials file, the Codex auth.json, config.toml and .env, the ChatGPT Desktop app's data folder, Gemini CLI's .env and workspace token, and GitHub Copilot's hosts.json. For editors built on VS Code (Cursor, Windsurf and VS Code itself) it takes globalStorage\state.vscdb, a SQLite database where these editors keep sign-in state. Symantec points out that Cursor's copy can also cache chat context and code snippets, so the thief may get pieces of source code as well. The module also queries Windows Credential Manager.

A second module, ide, goes after stored Git credentials, the .ssh folder, .aws\credentials, .aws\config, the .aws\sso\cache folder of single sign-on tokens, and Azure and Google Cloud configuration. Counting the products on Check Point's path list gives 13 AI and developer tools. Alongside them, the stealer still does the usual work: browser cookies and passwords, 21 desktop wallets and dozens of wallet extensions, Discord, Telegram, VPN and FTP clients, password managers, screenshots and the clipboard.

Before collecting, the malware can check the keyboard layout and interface language and stop on Russian, Ukrainian, Belarusian, Kazakh and several other locales from the former Soviet Union. It also looks for debuggers, virtual machines, sandbox user names such as WDAGUtilityAccount, and a mouse cursor that never moves.

Uploads in the newest samples take three HTTP POST requests to a /gate path on the command and control (C2) server. /gate/handshake sends a 32-byte X25519 public key, and nothing else goes out until the server answers HTTP 200. Each module's output is then zipped, encrypted with AES-256-GCM using a key derived from the shared secret and the string "aokigahara", and sent to /gate/chunk. A final /gate/complete carries the body "COMPLETE". Requests carry headers such as X-Build-ID, X-Gate-Token, X-HWID and X-KEX: x25519, with the User-Agent Microsoft-CryptoAPI/10.0. Symantec saw older samples send to an IP address on port 8080 over plain HTTP, and newer ones move to domains.

What a stolen token gives the attacker

The files above hold OAuth tokens, session data and API keys. A copied token lets someone act as the developer from another machine, with no password and no MFA prompt. Symantec lists what follows from that: running models on the victim's account and quota (often called LLMjacking), and reaching the repositories, cloud services and CI/CD pipelines the account connects to. A GitHub token from Copilot's config, or an AWS SSO token still inside its validity window, can matter more than the AI account itself.

Check Point adds that a hijacked AI session can expose conversation history and uploaded files, which opens a route to extortion. It also says plainly that it has not confirmed how the operators make money from the data.

What attackers are doing

Symantec says the family first appeared earlier in 2026, and that its older samples did not touch AI files, so the aisessions work is recent. Check Point describes the stealer as under active development, with the User-Agent changing between versions. The two vendors disagree on lineage: Check Point says an earlier version may have been known as Kamidere or Stygian, and its YARA rule includes the string "kamidere", while Symantec found no link to any known family. Neither has attributed it to a named group, and neither has published victim counts.

What to do

Block the infrastructure. Add Check Point's C2 hosts to DNS and proxy blocklists: dobeqnesmot.cc, hjazfioe.surf and neihite.cc (also in Symantec's list), plus dfwioeiofwr.info, gate.dfwioeiofwr.info, kkeyyou.cc, somelitersofblood.pw and 2.26.252.48 on port 8080. Search past DNS and proxy logs for the same names: Symantec found no command list in the malware, which simply uploads what it finds, so the trace may be a single burst of traffic.
Hunt the upload pattern. In proxy or firewall logs with HTTP visibility, look for POST requests to a path ending /gate/handshake, /gate/chunk or /gate/complete, and for any request carrying X-Gate-Token or X-KEX: x25519. Windows uses the Microsoft-CryptoAPI/10.0 User-Agent for certificate revocation checks, so a POST with that User-Agent to an unfamiliar domain deserves a look.
Hunt on disk. Load the hashes from both reports into your EDR. Run Check Point's aokigahara YARA rule, which looks for strings such as AKGRES, AISessions/ and /chunk. The clipper component, which swaps copied wallet addresses, drops under C:\Microsoft\Vault, which is not a folder Windows creates at the root of the drive. Symantec products name the detection Infostealer.Aoki.
If a machine is hit, re-image it and do every rotation below from a different, clean device. Anything you rotate on the infected host can be stolen again.
Revoke tokens and keys. A password change does not cancel an API key or an issued token. End all sessions for Claude, ChatGPT (Codex signs in through it), Cursor and Gemini from each account's settings, and replace Anthropic, OpenAI and Gemini API keys, including any in a .env file. In GitHub, revoke the Copilot and other OAuth app authorizations under Settings, Applications, and replace personal access tokens and SSH keys. In AWS, deactivate the access keys from .aws\credentials; for IAM Identity Center users, delete active sessions on the user's Active sessions tab and follow AWS's guidance for permission-set role sessions, which outlive the portal session. In Microsoft Entra ID, Revoke-MgUserSignInSession invalidates the user's refresh tokens.
Then check what the tokens were used for. Read usage pages in the Anthropic and OpenAI consoles for unexpected spend, the GitHub audit log for new tokens, clones and pushes, and CloudTrail for calls from the leaked access key IDs from unfamiliar IP addresses.

Hardening developer machines

Most of these tools write long-lived secrets into plain files under the user profile, readable by any process running as that user. Where a tool can use the operating system's credential store, turn it on: for Codex, set cli_auth_credentials_store = "keyring" in config.toml. Prefer short-lived AWS SSO sessions to static keys, and keep API keys in a secrets manager instead of .env files in home folders. On Windows, object access auditing on the .claude, .codex, .copilot and .aws folders produces Security event 4663 for each read, so a reader that is not the tool itself shows up.

Hunting for stealer activity and responding to it is part of our security operations work, and tightening how developer laptops store tokens falls under safeguarding and hardening. If you want help checking your developers' machines for Aokigahara, open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/, https://research.checkpoint.com/2026/26th-october-threat-intelligence-report/, https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting, https://www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/, https://news.risky.biz/risky-bulletin-while-everyone-was-looking-at-php-another-rce-is-wrecking-whats-left-of-the-internet, https://docs.aws.amazon.com/singlesignon/latest/userguide/revoke-user-permissions.html