Aoki infostealer has expanded its data theft capabilities to target credentials and session files used by AI coding assistants, including Claude, OpenAI Codex, Cursor and GitHub Copilot.
The Shift in Malware Focus
Symantec’s Threat Hunter team recently identified a significant change in the behavior of Aoki, also known as Aokigahara. Earlier versions of this malware did not search for AI-related files, suggesting that this new capability was added quite recently and remains under active development. First observed earlier in 2026, the tool is now designed to harvest credential and session files from a growing list of artificial intelligence development tools.
This evolution marks a departure from the malware’s initial focus on browser passwords, cryptocurrency wallets, and password manager data. The expansion indicates that threat actors are increasingly viewing access to AI models as a lucrative opportunity. Researchers have noted that Aoki is a relatively new stealer with capabilities still in active development, yet its target list has broadened to include tokens for Cursor, GitHub Copilot, Google Gemini, JetBrains AI Assistant and Kiro.
The malware also targets Codeium, showing that its collection scope extends across several AI development tools. This shift puts developer accounts and connected services at risk, extending the malware’s reach well beyond traditional financial data. The distinction between credentials and source code matters significantly in this context, as Aoki mainly collects authentication and session files rather than directly stealing source code.
How the Attack Works
When successful, stolen application programming interface keys and session tokens can allow attackers to carry out activity under a legitimate user’s identity. This practice lets malicious actors consume the victim’s paid API quota without triggering standard security alerts that assume requests originate from a trusted user. The Symantec researchers explained that this bypasses safeguards designed to protect developer environments.
The stolen credentials can expose connected repositories, cloud resources and continuous integration and continuous delivery pipelines linked to the compromised account. Attackers could resell working keys or use them to run AI workloads at the victim’s expense, a practice commonly called LLMjacking. Unlike card data, these stolen AI keys give an attacker a route into the developer’s wider environment, creating risks that extend far beyond simple financial theft.
The malware has no backdoor command list and collects available data, sending it to its command-and-control server through a /gate endpoint. Older samples used unencrypted HTTP over port 8080 for these communications. This approach means the software grabs whatever data is available on the system rather than executing specific interactive commands directed by an operator.
A Wide Net for Financial Gain
The rest of the stealer’s target list includes a focus on cryptocurrency related wallets and extensions, indicating that the attackers are financially motivated. Aoki continues to collect sensitive information from dozens of browsers, including Chrome, Edge, Firefox, Brave and Opera. Its cryptocurrency targets include browser extensions such as MetaMask, Phantom, Coinbase, Binance, Trust and many others.
The software also searches filenames for terms associated with recovery material, including mnemonic, private_key, passphrase, keystore and 24word. Desktop wallets are not spared either, with the malware targeting Exodus, Atomic, Electrum, Ethereum keystore and Bitcoin Core among others. It also looks for files containing specific keywords like wallet or phrase in their names.
Beyond financial assets, the tool targets Discord and Telegram sessions, gaming accounts, Outlook passwords, Thunderbird profiles, FTP clients, VPN applications and password managers. It records installed security products on the victim machine. This comprehensive approach ensures that any valuable digital asset is collected and sent to the command-and-control server through the /gate endpoint.
The Human Impact for Developers
This development means that developers who rely on AI coding assistants must now consider their authentication data as high-value targets. The human side of this threat involves protecting not just code, but the identities and financial resources tied to those digital credentials. What this means for patients in a broader sense is that anyone using technology to improve their work or life faces new risks that require careful attention.
For families and individuals working with these tools, understanding that AI credentials are now considered valuable by threat actors is essential. The researchers emphasized that Aoki’s development suggests that AI credentials are now considered just as valuable as payment card data and cryptocurrency wallets by threat actors. This reality requires a shift in how developers think about security hygiene.
The malware’s capabilities still appear to be in active development, according to Symantec. Researchers have not identified its operators or established links to another malware family. However, the rest of the stealer’s target list indicates that the attackers are financially motivated, making this a persistent threat that will likely evolve as developers adapt their security practices.
Developers should remain vigilant about protecting their authentication tokens and API keys, especially when using AI coding assistants in their daily workflows. The fact that Aoki is poorly documented and its operators remain unknown adds an element of uncertainty to the security landscape. Staying informed about these evolving threats helps protect both personal data and professional reputation.
Specific File Targets and Browser Scope
Beyond the new AI assistant targets, Aoki maintains its traditional focus on financial assets found within dozens of browsers. The malware scans Chrome, Edge, Firefox, Brave, and Opera for sensitive data stored in extensions like MetaMask, Phantom, Coinbase, Binance, Trust, and MetaMask (Edge). It also monitors specific desktop wallets including Exodus, Atomic, Electrum, Ethereum keystore, Bitcoin Core, Zcash, Armory, Bytecoin, Jaxx, Guarda, Coinomi, Wasabi, Dogecoin, Dash, Litecoin, Monero, Daedalus, Ledger Live, and TokenPocket.
The software actively searches filenames for keywords associated with recovery materials to locate private keys. Terms such as mnemonic, private_key, passphrase, keystore, secret, 12word, 24word, backup, wallet, and phrase trigger the collection process. This broad search ensures that any valuable digital asset stored locally is identified and transmitted to the command-and-control server via the /gate endpoint.
In addition to financial credentials, the infostealer captures session tokens for messaging platforms like Discord and Telegram, gaming accounts, Outlook passwords, Thunderbird profiles, FTP clients, VPN applications, and various password managers. It also records installed security products on the victim machine. This comprehensive approach ensures that authentication data from diverse digital environments is gathered without executing specific interactive commands directed by an operator.
Sources
- Aoki Infostealer Expands Attacks to Claude, Codex, Cursor and GitHub Copilot
- Aoki: Infostealer Targets AI Coding Assistant Credentials
- New Aoki Infostealer Targets AI Coding Assistant Credentials
Photo: Sai Kiran Anagani _imkiran (CC0)
