New Aoki infostealer targets ChatGPT, Claude, Codex, Cursor, Codeium, Gemini cre
By Omar Ahmed · October 17, 2026 · Curated by George's Blog
New Aoki infostealer targets ChatGPT, Claude, Codex, Cursor, Codeium, Gemini credentials.
Problem:
Aoki, also known as Aokigahara, is an InfoStealer that added AI tools to its collection rules. Symantec Threat Hunter found newer samples search local files and session data tied to ChatGPT, Claude, OpenAI Codex, Cursor, Codeium and Gemini, plus tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro.
This is not a flaw in an AI service. The malware steals credentials and session token theft from the infected device itself.
The report names specific artifacts:
- .claude.json
- Claude desktop cookies
- ChatGPT cookies
- Codex config.toml and .env files
- Cursor local state database
Those files can hold login sessions, settings and secrets used by local tools. Symantec says the focus is credentials and session data, not source code itself. The family is labeled Infostealer.Aoki.
Agitation:
A stolen token can let an intruder act as the account owner, consume paid quota or resell access. That abuse is often called LLMjacking. For developers, the same token may expose connected repositories, cloud services and CI/CD pipelines. Multi-factor authentication may not stop an attacker from reusing a token already stolen from a device.
Aoki also collects browser cookies, saved passwords, autofill details, credit-card data and Google tokens. Other targets include crypto wallets, password managers, VPN and file-transfer apps, gaming services, and Telegram and Discord data.
Newer samples used several domains; older ones used an IP on port 8080 over unencrypted HTTP. Collected data goes to a C2 /gate endpoint. One infected device can become access to several accounts.
Solution:
Treat AI configuration files and local session data as sensitive, much like cloud keys and source-control credentials. Symantec published 17 file hashes labeled Infostealer.Aoki and three domains:
- dobeqnesmot.cc
- hjazfioe.surf
- neihite.cc
A match is a reason to investigate, not proof of infection.
If compromise is suspected, use a clean device to revoke active AI sessions, rotate exposed API keys and related credentials, and review account activity. Check connected repositories and cloud services for unexpected use.
Developers should avoid saving long-lived secrets in files accessible to local applications, limit tokens to the permissions and time needed, and remove or replace exposed keys. Security teams should monitor unexpected access to AI tool folders and unusual outbound connections. Update defenses against new malware as soon as it appears and integrate threat intelligence feeds with SOC data.
How is your team securing your infrastructure against this type of exploitation? Let’s discuss in the comments below.
#InfoStealer #AIcredentialtheft #LLMjacking
Full Article: https://lnkd.in/dCj2mKbw