Security56 mOctober 20, 2026, 23:13

Aoki infostealer now targets AI coding assistant credentials

Symantec's Threat Hunter team reported on October 15 that new Aoki (Aokigahara) infostealer samples specifically hunt credentials for AI coding tools: .claude.json, Claude desktop and ChatGPT cookies, Codex config.toml and .env files, plus tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, along with AWS keys. Earlier samples ignored these files, so the capability was added recently and is still expanding.

DEV Community

Open source

Aoki infostealer now targets AI coding assistant credentials

Aoki grabs .claude.json, Claude and ChatGPT cookies, Codex config.toml and .env
Targets include tokens for Copilot, Cursor, Gemini, JetBrains AI and Kiro
The stealer first appeared in 2026; AI file targeting is a recent addition
Stolen keys are resold on 125 Telegram marketplaces within hours

#Symantec#Claude#ChatGPT#GitHubCopilot

Rapuncel Infostealer Disabled 145 Security Tools Before Stealing Credentials

Security

Claude and ChatGPT sessions sold for $5 on Telegram after infostealer theft

Security

Aoki infostealer now targets AI coding assistant credentials

Rapuncel Infostealer Disabled 145 Security Tools Before Stealing Credentials

Claude and ChatGPT sessions sold for $5 on Telegram after infostealer theft

Descope's Agentic Identity Hub 3.0 targets shadow AI agents in companies

Use.ai Hits 1 Million Monthly Users as Average AI User Runs Three Assistants