Aoki Infostealer Targets AI Coding Assistants for Credential Theft
In short
Symantec identified expanded Aoki infostealer variants that harvest credentials from AI coding assistants, enabling LLMjacking and unauthorized access to linked services.
The Aoki infostealer has added targeted collection of API keys and session data from AI coding assistants. A Symantec Threat Hunter Team report published 15 October 2026 documented this shift in samples analyzed after August 2026. Developers who store tokens for tools such as Claude or ChatGPT now face direct exposure of those credentials.
Changes in Aoki Infostealer Behavior Since Early 2026
Earlier Aoki variants focused on browsers, cryptocurrency wallets and password managers. They collected cookies, autofill data and extension files from roughly 40 browsers and more than 80 wallet extensions. No AI-related configuration files appeared in those samples.
Newer variants expand the collection list to include specific AI assistant files. The malware reads local JSON files, cookies and configuration documents that contain authentication tokens. It then sends the data over HTTPS to command-and-control domains such as dobeqnesmot.cc/gate and hjazfioe.surf/gate. No remote command execution occurs; the sample simply exfiltrates whatever files it finds.
Symantec assigned the detection name Infostealer.Aoki and published 17 SHA-256 hashes associated with the updated family. Behavioral and machine-learning detections cover the new file-access patterns. Researchers note ongoing development, with additional AI targets expected in future builds.
AI Coding Tools and Files Collected by Current Samples
The malware targets configuration and session data from multiple AI coding platforms. Collection includes both cloud API tokens and local state databases that may contain chat history or code snippets.
- Claude: .claude.json and desktop application cookies
- OpenAI: ChatGPT cookies, Codex config.toml and .env files
- GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant, Kiro and Codeium tokens
- AWS credentials stored in local environment files
Cursor local state database files are also read because they cache recent interactions. The same samples continue to harvest data from password managers, VPN clients and messaging applications, broadening the overall intelligence gathered in a single infection.
| Category | Examples | Collected Items |
|---|---|---|
| AI Assistants | Claude, ChatGPT, Gemini | API tokens, cookies, config files |
| Development Tools | GitHub Copilot, Cursor, JetBrains | Session tokens, local state DB |
| Cloud Services | AWS | Access credentials |
| Legacy Targets | Browsers, Wallets | Cookies, extensions, passwords |
Practical Risks and Recommended Detection Steps
Stolen API keys allow attackers to abuse paid quotas or resell access under the term LLMjacking. OAuth tokens linked to GitHub or cloud accounts can expose private repositories and CI/CD pipelines without triggering standard account alerts. Financially motivated actors value these credentials at levels comparable to credit-card data or cryptocurrency holdings.
Organizations can hunt for the specific file reads listed in the Symantec report followed by outbound HTTPS traffic to the known gate domains. Endpoint detection rules should flag processes that access multiple AI configuration paths in quick succession. Regular rotation of AI service keys and storage of tokens outside default application directories reduce the window of exposure if an infection occurs.
No confirmed victim counts or downstream abuse cases have been published. MalwareBazaar first recorded AokigaharaStealer samples on 11 August 2026, indicating the AI-targeting capability is recent and still expanding.
Frequently asked questions
What files does the Aoki infostealer target from AI coding tools?
Current samples read .claude.json, ChatGPT cookies, Codex config files, Cursor local state databases and tokens for GitHub Copilot, Gemini and JetBrains AI Assistant.
How does Aoki exfiltrate stolen AI credentials?
The malware sends collected data over HTTPS to domains such as dobeqnesmot.cc/gate and hjazfioe.surf/gate without installing any backdoor components.
What is LLMjacking and why does it matter for stolen AI keys?
LLMjacking refers to unauthorized use of a victim API quota or resale of the token. It can generate unexpected charges and grant access to any services tied to the compromised identity.
When did Aoki first appear with AI-targeting capabilities?
MalwareBazaar records show AokigaharaStealer samples from 11 August 2026, with the AI file collection feature confirmed in Symantec analysis published 15 October 2026.
TrustScope
Comments 6