Do Son 
At a Glance
| Malware Family | Aoki infostealer (also tracked as Aokigahara) |
| Threat Actor | Unattributed (financially motivated; no confirmed or suspected links to known groups) |
| Target / Victims | Software developers using 8 AI coding tools, 41 web browsers, 67 wallet extensions, and 21 desktop wallets (17 malicious file hashes analyzed; victim total undisclosed) |
| Delivery Vector | Unspecified initial vector (executed as standalone Windows credential-harvesting binaries) |
| Key Capabilities | AI token and config harvesting, browser and crypto wallet theft, local security software enumeration |
| Sources | Symantec and Carbon Black Threat Hunter Team (Broadcom) |
TL;DR
The Symantec and Carbon Black Threat Hunter Team discovered that recent builds of the Aoki infostealer target credentials from AI coding tools. Specifically, the Aokigahara Aoki infostealer harvests API keys and session files from Claude, OpenAI Codex, Cursor, Codeium, and Google Gemini. Furthermore, stolen tokens allow attackers to abuse paid API quotas and reach connected cloud pipelines.
Delivery and Attribution
Analysts first observed this malware family earlier in 2026 across 17 analyzed file samples. While the initial delivery vector remains unspecified in vendor telemetry, the binary targets Windows-specific paths such as the system registry and Edge WebView2. The malware takes its name from a decryption string referencing Aokigahara, a famous forest in Japan.
However, neither confirmed attribution nor suspected attribution applies to a known threat group. As the Symantec and Carbon Black report states, “We do not know what threat group may be behind this malware and there are no indications that it has links to any existing malware family.” Even so, the heavy focus on cryptocurrency wallets indicates a strong financial motive.
Infection Chain
Older builds of the Aoki infostealer ignored developer tools completely. In contrast, the newest version searches local directories for AI configuration files, including Claude settings, ChatGPT cookies, and Codex environment files. Additionally, the malware extracts authentication tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant, Kiro, and Amazon Web Services.
Browser and Wallet Harvesting
Although the stealer targets credentials rather than raw source code, it grabs the Cursor local state database, which caches chat logs and code snippets. Alongside AI files, the Aokigahara Aoki infostealer loots data from 41 web browsers, 67 browser wallet extensions, and 21 desktop cryptocurrency apps. It also collects passwords from seven password managers, six VPN clients, five FTP tools, and Telegram and Discord sessions before listing installed security software.
Command-and-Control and Exfiltration
Unlike full remote access trojans, the Aoki infostealer contains no backdoor command list. Instead, it gathers local files in a single pass and sends the bundle to a command server via a gate endpoint. While older builds transmitted stolen data over unencrypted HTTP on port 8080, newer samples communicate over HTTPS using dedicated domains.
Defense and Detection Guidance
Stolen AI keys expose organizations to both financial fraud and supply chain breaches. According to the researchers, “Like card data, a stolen AI key can be cashed in directly, either through resale or by running up usage on the victim’s account, a practice sometimes called LLMjacking.” Therefore, defenders should block suspect executables using behavioral endpoint controls and monitor outbound traffic to untrusted domains. Finally, compromised developers must revoke exposed API keys, replace OAuth tokens, rotate AWS credentials, and audit cloud billing logs for unauthorized usage.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
