Aoki Infostealer Expands Its Haul to AI Assistants
Aoki is a new and fast-evolving infostealer with an unknown operator. It has moved past passwords and crypto wallets to grab one of the most valuable prizes on a developer’s machine: the keys to AI coding assistants like Claude, ChatGPT, Codex, Cursor, and GitHub Copilot.
Summary
- First Seen
- 2026
- Targeted Regions
- Worldwide
- Targeted Platform
- Windows
- Targeted Products
- Claude, ChatGPT, OpenAI Codex, Cursor, GitHub Copilot, Google Gemini, JetBrains AI Assistant, Kiro, Codeium, Amazon Web Services (AWS), Web Browsers, Cryptocurrency Wallets, Discord, Telegram, Steam, Roblox, Epic Games, Battle.net, Riot, Minecraft, GOG, Origin, Ubisoft, Microsoft Outlook, Mozilla Thunderbird, FileZilla, WinSCP, CoreFTP, FlashFXP, SmartFTP, OpenVPN, NordVPN, ProtonVPN, PIA, Surfshark, Windscribe, KeePass, Bitwarden, 1Password, Dashlane, RoboForm, NordPass, Sticky Password
- Malware
- Aoki (aka Aokigahara)
Aoki is a new and fast-evolving infostealer with an unknown operator. It has moved past passwords and crypto wallets to grab one of the most valuable prizes on a developer’s machine: the keys to AI coding assistants like Claude, ChatGPT, Codex, Cursor, and GitHub Copilot. With those tokens in hand, attackers can work as the developer, move into repositories, cloud accounts, and CI/CD pipelines, and run up AI bills through LLMjacking. That makes every compromised workstation a possible gateway to the wider software supply chain.
Attack Details
Aoki, also known as Aokigahara, is an information stealer first seen in 2026 and still under active development. It has no known links to other malware families, and nobody knows who is behind it. How it reaches victims and which regions or industries it targets has not been disclosed. Once it runs, Aoki does not take commands from an attacker. It simply collects every piece of data it can from the infected machine. It also notes which security products are installed, so its operators can see what defenses each victim has.
What stands out in the newest versions is that they steal credentials from AI coding assistants. Aoki takes login tokens, session cookies and configuration secrets for Claude, ChatGPT, OpenAI Codex, Cursor, GitHub Copilot, Google Gemini, JetBrains AI Assistant, Kiro and Codeium, along with AWS credentials. It does not go after source code. Even so, these secrets let an attacker act as the developer. They can reach linked repositories, cloud services and CI/CD pipelines, and run up AI usage charges on the victim's account (known as LLMjacking).
Aoki also steals the usual infostealer targets. These include data saved in around 50 web browsers, cryptocurrency wallets, Discord and Telegram accounts, and gaming platforms such as Steam and Roblox. It also takes email credentials, saved FTP and VPN details, and password manager data.
Recommendations
- 01Rotate AI Assistant Keys and TokensOn any host suspected of Aoki infection, revoke and reissue API keys, OAuth tokens, and session tokens for Claude, ChatGPT, OpenAI Codex, Cursor, GitHub Copilot, Gemini, JetBrains AI Assistant, Kiro, and Codeium, and force sign-out of active desktop and browser sessions.
- 02Rotate Cloud and Pipeline CredentialsRevoke AWS access keys and any secrets stored in .env or config.toml files on affected developer machines, then review repository, cloud, and CI/CD audit logs for activity performed with the stolen identities.
- 03Block Aoki Network InfrastructureAdd the listed domains and
/gateURLs to DNS, proxy, and firewall blocklists, and alert on outbound HTTP POST requests to/gatepaths or to unfamiliar .cc and .surf domains. - 04Monitor AI API Usage for LLMjackingSet usage alerts, spend caps, and anomaly detection on AI provider accounts so that sudden spikes in consumption or requests from unexpected locations are caught quickly.
- 05Enforce Application Control on Developer WorkstationsApply allowlisting so that unsigned or unknown executables cannot run on machines that hold privileged AI, source control, and cloud credentials.
- 06Bind Sessions to Strong AuthenticationRequire phishing-resistant MFA on code hosting, cloud, and AI platforms, and favour providers' session binding features so stolen cookies cannot be easily replayed.
Indicators of Compromise (IoCs)
| Type | Value |
|---|---|
| SHA256 | 752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b36655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af5192fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d9473dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb89607bc2e3a1d14743cc44f1dc4c78d15d0f2b458b39fb48422b13df40fc662ba21c533570fd7cd7eaf5478317b03ea5750d03797aa4d11ebd96555b6cb708c63f26350dfee6975a9b159c5a57a3e97f757b0b02fd2dc708016fa6d7270e720c86536af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b039240551f88b0064b2615dffdc1321b1e7c58e3f617ac138a65a6d59400b3310e38bd3c30a4ca08641240ce95b5b6ba593e131213ca1b2a28da4e0385fcabc43b4547f0d7549274f366cd9568b3d302c1e80e1b89359da681beb47260ec7975b590235493487c51f7050b341c9b2450e4f761ad6055207e4f6daf0cecae271ce374f9ff5094f728528efa566c3de1b7fea7d95f497242a01fffa6c70b5eb768f779314b1a5a0b297fd4e2a5f9c1e40d387b3e7c401d42324b556a70f813840e |
| Domains | dobeqnesmot[.]cchjazfioe[.]surfneihite[.]cc |
| URLs | hxxps[:]//dobeqnesmot[.]cc/gatehxxps[:]//hjazfioe[.]surf/gatehxxps[:]//neihite[.]cc/gate |
MITRE ATT&CK TTPs
References & Patch Links
References
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)