al-ice.ai

Aoki Wants Your Agent’s Keys, Not Your Code: Symantec Tracks an Infostealer’s New Taste for AI Coding Credentials

Agent & Supply Chain Security by al-ice.ai Editorial

On 15 October 2026, Symantec’s Threat Hunter Team reported that a little-documented infostealer it tracks as Aoki (aka Aokigahara) has added AI coding assistants to its shopping list. Recent samples harvest credential and session files for Claude, OpenAI’s Codex, Cursor, Codeium, and Gemini — specifically .claude.json, Claude desktop cookies, ChatGPT cookies, and the Codex config.toml and .env files — alongside tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant, and Kiro, plus AWS credentials. Older samples collected browsers, wallets, and password managers but nothing AI-related, so the capability is a recent addition — and, the researchers say, an expanding one.

This lands six days after our Warden Stealer briefing, and the proximity is the story, not a duplication. Warden is a marketed malware-as-a-service product whose AI-agent collection became an official, price-hiked feature in v1.9. Aoki is something else: a sparsely documented family, first seen earlier in 2026, with no known threat group behind it and no links to any existing malware family, quietly growing the same appetite. Two independent data points in a week, from two different vendors, describing two different codebases converging on the same target. The agent config directory is now simply where the credentials are.

What Aoki takes, and the one exception that matters

The AI haul is files that authenticate, not files that contain code. API keys, OAuth and session tokens, saved credentials — the material an attacker needs to act under a legitimate developer’s identity and API quota, reaching the connected repositories, cloud services, and CI/CD pipelines behind the account, and slipping past safeguards that assume requests come from a trusted user. Symantec draws the significance line bluntly: like stolen card data, a stolen AI key can be cashed in directly — resold, or burned through on the victim’s account in the practice sometimes called LLMjacking. Unlike card data, it also hands over a route into the developer’s wider environment. And there is one exception to the no-source-code rule that defenders should sit with: the Cursor local-state database, which can cache chat context and code snippets. Stealing the session file there means stealing fragments of the codebase and the conversation about it — context an attacker can mine for secrets, architecture, and the next target.

The rest of the list says “money”

Aoki’s non-AI targeting is sprawling, and its shape points at financial motive. Dozens of browsers (Chromium family, Firefox forks, WebView2, and a long tail of regional builds); more than sixty wallet browser extensions plus desktop wallets from Exodus to Ledger Live; a filename hunt for mnemonic, privatekey, passphrase, 12word, and 24word; Discord tokens across the stock clients and a dozen third-party mods; Telegram sessions (tdata, 64Gram, AyuGram, and others); Steam, Roblox, Epic, Battle.net, and Riot gaming files; Outlook registry passwords and Thunderbird profiles; FileZilla, WinSCP, and CoreFTP credentials; OpenVPN, NordVPN, ProtonVPN, and PIA configurations; password-manager stores including KeePass config, Bitwarden, 1Password, Dashlane, and RoboForm — plus a survey of which security products are installed. The researchers also read the Telegram and Discord interest as victim-graph expansion: sessions that lead to the victim’s contacts, who become the next victims. The malware itself is unglamorous by design — no backdoor command list, just collect-everything and exfiltrate to a /gate endpoint. Most newer samples phone home to a single domain; two use a domain of their own; older samples used a bare IP over unencrypted HTTP on port 8080. Symantec detects the family as Infostealer.Aoki and publishes file hashes plus three network IoCs: dobeqnesmot[.]cc, hjazfioe[.]surf, and neihite[.]cc.

What to do

  • Say it again for the new family: the agent config directory is a credential store. ~/.claude.json, Codex config.toml/.env, Cursor state, Copilot and Gemini tokens — restrict permissions, keep them out of backups and dotfile repos that leave the trust boundary, and never paste them into tickets or gists.
  • Treat Cursor’s cached context as sensitive data. Chat history and code snippets sitting in a local state database are a codebase leak waiting for a stealer. Prefer workspaces without secrets in context, and know what your assistant persists to disk.
  • Scope keys so theft is bounded. Short-lived, least-privilege tokens per project; MCP servers that reference a vault instead of embedding secrets; API quotas with alerts. A stolen key should buy the attacker one room, not the building.
  • Watch the identity, not just the endpoint. Stolen session tokens bypass the endpoint entirely — the malicious activity arrives as the legitimate user. Alert on anomalous API usage, new geographies, and quota spikes on AI-provider accounts, and make token revocation a one-step runbook, not a support ticket.
  • Block and detect the knowns. Symantec’s Infostealer.Aoki detection, the published file hashes, and the three /gate domains are immediate wins — while remembering that two samples already use infrastructure of their own.

Verification note: the family naming (Aoki aka Aokigahara, decryption-string origin, unclear link to the Japanese forest name), first-seen timing (earlier in 2026), absence of group attribution and family links, the AI target list (.claude.json, Claude desktop cookies, ChatGPT cookies, Codex config.toml and .env, Copilot/Cursor/Gemini/JetBrains/Kiro tokens, AWS credentials), the no-source-code rule and its Cursor local-state exception, the identity-and-quota abuse model, the breadth of the non-AI target list, the /gate C2 shape and its three domains, the older IP-and-port-8080 samples, the Infostealer.Aoki detection name, and the significance framing (card-data comparison, LLMjacking, Telegram/Discord victim-graph reading) were read first-hand from the Symantec (security.com) Threat Hunter Team blog HTML published 15 October 2026 and fetched on 16 October 2026, cross-checked against Infosecurity Magazine’s 15 October summary of the same research. We tested nothing and infected nothing.

Sources: