New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials

Aoki, also known as Aokigahara, is a data-stealing malware that has added credentials for AI tools to its growing list of targets. Recent versions seek local files and session data linked to ChatGPT, Claude, OpenAI Codex, Cursor, Codeium and Gemini.

The change raises the risk for developers who use AI assistants alongside source-code repositories, cloud accounts and other work systems.

Unlike a flaw in an AI service, Aoki’s activity focuses on data stored on an infected computer. A stolen key or token may let an intruder use an account as its owner, run up paid usage or reach services connected to that account.

Earlier Aoki samples did not search for AI-related files, suggesting this is a newer addition to the malware’s collection rules. Researchers from Symantec’s Threat Hunter team identified the expanded targeting.

Symantec’s Threat Hunter team analysis found that newer Aoki versions search for files linked to Claude, ChatGPT and Codex, as well as tokens used by services such as GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro.

The Symantec Aoki threat report also describes the malware’s wider reach across browsers, wallets and messaging apps. The files named in the report include .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files. These can contain login sessions, settings or secrets used by local tools.

Aoki also targets Cursor’s local state database, which may hold chat context and code snippets. Symantec says the main focus is credentials and session data, rather than source code itself.

New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini

Aoki does not stop at AI tools. It can collect browser cookies, saved passwords, autofill details, credit-card data and Google tokens from a broad range of browsers.

Its other targets include cryptocurrency wallet files and extensions, password managers, VPN and file-transfer applications, gaming services, and Telegram and Discord data. It also records which security products are installed on the computer.

That broad collection can turn one infected device into a source of access to several accounts. For developers, a stolen token may expose more than an AI subscription: connected repositories, cloud services and continuous integration and delivery pipelines could also be at risk.

The growing focus on locally stored agent data has been seen in other reporting on AI coding agent data theft, though that coverage describes other malware families, not Aoki.

Aoki sends collected information to a command-and-control server using a /gate endpoint. Symantec says newer samples used several domains, while older samples used an IP address and port 8080 over unencrypted HTTP.

The report does not name a threat group behind Aoki, and it does not link the malware to a known family. Its name comes from “Aokigahara,” a string used during the malware’s decryption process.

The theft of AI credentials can also lead to direct costs. An intruder may use a victim’s account quota or resell access; abusing paid AI services in this way is often called LLMjacking. A separate report on stolen AWS keys used for LLMjacking shows how compromised cloud credentials can be used to run paid AI models at the account owner’s expense. Aoki’s reported focus, however, is stealing data from infected devices.

This pattern is not limited to Aoki. Cyber Security News has reported on a fake Gemini npm package that targeted credentials and local data from several AI development tools.

The incidents underline why developers should treat AI configuration files and local session data as sensitive, much like cloud keys and source-control credentials.

What defenders should check

Organizations should look for the indicators below in endpoint and network records. A match is a reason to investigate, not proof on its own that a device is infected.

If a system is suspected of compromise, teams should use a clean device to revoke active AI sessions, rotate exposed API keys and related credentials, and review account activity.

They should also check connected repositories and cloud services for unexpected use. These steps matter because multi-factor authentication may not stop an attacker from reusing a token already stolen from a device.

Developers should avoid saving long-lived secrets in files that are accessible to local applications, limit tokens to the permissions and time needed, and remove or replace exposed keys.

Security teams can monitor for unexpected access to AI tool folders and unusual outbound connections, then compare findings with the indicators below. Symantec identifies the family as Infostealer.Aoki.

Indicators of compromise (IoCs):-

Type	Indicator	Reported label or note
File hash	752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69	Infostealer.Aoki
File hash	bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf	Infostealer.Aoki
File hash	0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3	Infostealer.Aoki
File hash	6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999	Infostealer.Aoki
File hash	780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519	Infostealer.Aoki
File hash	2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94	Infostealer.Aoki
File hash	73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896	Infostealer.Aoki
File hash	07bc2e3a1d14743cc44f1dc4c78d15d0f2b458b39fb48422b13df40fc662ba21	Infostealer.Aoki
File hash	c533570fd7cd7eaf5478317b03ea5750d03797aa4d11ebd96555b6cb708c63f2	Infostealer.Aoki
File hash	6350dfee6975a9b159c5a57a3e97f757b0b02fd2dc708016fa6d7270e720c865	Infostealer.Aoki
File hash	36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b	Infostealer.Aoki
File hash	039240551f88b0064b2615dffdc1321b1e7c58e3f617ac138a65a6d59400b331	Infostealer.Aoki
File hash	0e38bd3c30a4ca08641240ce95b5b6ba593e131213ca1b2a28da4e0385fcabc4	Infostealer.Aoki
File hash	3b4547f0d7549274f366cd9568b3d302c1e80e1b89359da681beb47260ec7975	Infostealer.Aoki
File hash	b590235493487c51f7050b341c9b2450e4f761ad6055207e4f6daf0cecae271c	Infostealer.Aoki
File hash	e374f9ff5094f728528efa566c3de1b7fea7d95f497242a01fffa6c70b5eb768	Infostealer.Aoki
File hash	f779314b1a5a0b297fd4e2a5f9c1e40d387b3e7c401d42324b556a70f813840e	Infostealer.Aoki
Domain	dobeqnesmot[.]cc	Network IOC
Domain	hjazfioe[.]surf	Network IOC
Domain	neihite[.]cc	Network IOC
URL	hxxps://dobeqnesmot[.]cc/gate	C&C endpoint
URL	hxxps://hjazfioe[.]surf/gate	C&C endpoint
URL	hxxps://neihite[.]cc/gate	C&C endpoint

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.