Aoki: Infostealer Targets AI Coding Assistant Credentials

The Aoki infostealer (also known as Aokigahara) has evolved to target credentials and session tokens from AI coding assistants such as Claude, OpenAI's Codex, Cursor, Codeium, and Google Gemini. This recent capability expansion indicates attackers are increasingly valuing AI-related tokens for identity impersonation, quota abuse, and access to connected repositories and CI/CD pipelines. The malware also steals data from browsers, cryptocurrency wallets, password managers, messaging apps, gaming platforms, and VPN clients, sending exfiltrated data to command-and-control servers via HTTP. The threat actor behind Aoki remains unidentified, but the malware's broad targeting suggests a financially motivated campaign with potential for supply chain and cloud environment compromise.

AI-extracted · verify before operational use