New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials

Aoki, also known as Aokigahara, is a data-stealing malware that has added credentials for AI tools to its growing list of targets. Recent versions seek local files and session data linked to ChatGPT, Claude, OpenAI Codex, Cursor, Codeium and Gemini.

The change raises the risk for developers who use AI assistants alongside source-code repositories, cloud accounts and other work systems.

Unlike a flaw in an AI service, Aoki’s activity focuses on data stored on an infected computer. A stolen key or token may let an intruder use an account as its owner, run up paid usage or reach services connected to that account.

Earlier Aoki samples did not search for AI-related files, suggesting this is a newer addition to the malware’s collection rules. Researchers from Symantec’s Threat Hunter team identified the expanded targeting.

Symantec’s Threat Hunter team analysis found that newer Aoki versions search for files linked to Claude, ChatGPT and Codex, as well as tokens used by services such as GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro.

The Symantec Aoki threat report also describes the malware’s wider reach across browsers, wallets and messaging apps. The files named in the report include .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files. These can contain login sessions, settings or secrets used by local tools.

Aoki also targets Cursor’s local state database, which may hold chat context and code snippets. Symantec says the main focus is credentials and session data, rather than source code itself.

New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini

Aoki does not stop at AI tools. It can collect browser cookies, saved passwords, autofill details, credit-card data and Google tokens from a broad range of browsers.

Its other targets include cryptocurrency wallet files and extensions, password managers, VPN and file-transfer applications, gaming services, and Telegram and Discord data. It also records which security products are installed on the computer.

That broad collection can turn one infected device into a source of access to several accounts. For developers, a stolen token may expose more than an AI subscription: connected repositories, cloud services and continuous integration and delivery pipelines could also be at risk.

The growing focus on locally stored agent data has been seen in other reporting on AI coding agent data theft, though that coverage describes other malware families, not Aoki.

Aoki sends collected information to a command-and-control server using a /gate endpoint. Symantec says newer samples used several domains, while older samples used an IP address and port 8080 over unencrypted HTTP.

The report does not name a threat group behind Aoki, and it does not link the malware to a known family. Its name comes from “Aokigahara,” a string used during the malware’s decryption process.

The theft of AI credentials can also lead to direct costs. An intruder may use a victim’s account quota or resell access; abusing paid AI services in this way is often called LLMjacking. A separate report on stolen AWS keys used for LLMjacking shows how compromised cloud credentials can be used to run paid AI models at the account owner’s expense. Aoki’s reported focus, however, is stealing data from infected devices.

This pattern is not limited to Aoki. Cyber Security News has reported on a fake Gemini npm package that targeted credentials and local data from several AI development tools.

The incidents underline why developers should treat AI configuration files and local session data as sensitive, much like cloud keys and source-control credentials.

What defenders should check

Organizations should look for the indicators below in endpoint and network records. A match is a reason to investigate, not proof on its own that a device is infected.

If a system is suspected of compromise, teams should use a clean device to revoke active AI sessions, rotate exposed API keys and related credentials, and review account activity.

They should also check connected repositories and cloud services for unexpected use. These steps matter because multi-factor authentication may not stop an attacker from reusing a token already stolen from a device.

Developers should avoid saving long-lived secrets in files that are accessible to local applications, limit tokens to the permissions and time needed, and remove or replace exposed keys.

Security teams can monitor for unexpected access to AI tool folders and unusual outbound connections, then compare findings with the indicators below. Symantec identifies the family as Infostealer.Aoki.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials appeared first on Cyber Security News.