Guard AI Coding Tokens: Aoki Malware Steals Session Keys for Claude, ChatGPT, and Cursor

Recent variants of the Aoki infostealer, also known as Aokigahara, have expanded their data collection to include credentials for AI coding assistants. According to Symantec’s Threat Hunter Team, these newer samples target authentication material from tools such as Claude, ChatGPT, OpenAI Codex, Cursor, Codeium, and Gemini. This development marks a shift from the malware's earlier capabilities, which were observed earlier in 2026 but lacked routines for harvesting data from these specific artificial intelligence applications.

The theft of these credentials poses risks beyond simple account takeover. Symantec researchers state that stolen API keys, OAuth tokens, and session tokens can enable attackers to operate under a legitimate developer’s identity. This access allows the threat actors to consume the victim’s API quota, a practice often referred to as LLMjacking. Furthermore, depending on the permissions and integrations configured by the victim, the compromised authentication material could expose sensitive repositories, cloud services, and continuous integration and continuous delivery pipelines.

Scope of the Collection Effort

The malware continues to target a wide array of applications beyond AI tools. Symantec reports that the collection routines still focus on conventional browser data from the Chromium and Firefox families, alongside cryptocurrency wallet information. The software also searches for specific filenames containing terms related to mnemonic phrases, private keys, passphrases, and keystores. Additionally, the infostealer retrieves data from messaging platforms, including Discord variants and Telegram clients, as well as email applications like Outlook and Thunderbird.

Attackers are also harvesting credentials from VPN software, FTP clients, password managers, and gaming clients. The malware identifies installed security products on the compromised endpoint. Despite this broad collection capability, Symantec noted that they lack visibility into the exact number of affected victims. This limitation makes it difficult to distinguish between the malware's demonstrated technical capabilities and confirmed operational consequences in the wild.

Assessment of Operational Impact

Researchers emphasize that the findings concern credentials harvested from compromised endpoints rather than a reported breach of the AI providers themselves. While the immediate opportunity includes unauthorized AI consumption or the resale of access, researchers have not established downstream exploitation in this specific campaign. Controls that trust authenticated requests may provide insufficient protection against credential reuse, highlighting the value of the stolen tokens. The appearance of these new collection routines indicates active development by the attackers, who are broadening their targets to include authentication material stored by increasingly popular development tools.

What to watch

Organizations should monitor for unauthorized API usage spikes that could indicate LLMjacking. Security teams should watch for new indicators of compromise related to the Aoki infostealer. Symantec will continue to track the evolution of these variants. Users should expect increased scrutiny on how development tools store session tokens. No fix has been confirmed yet for the identified collection routines.

What made it possible

This incident illustrates the risk of local credential storage in development environments. Attackers exploit the trust placed in authenticated requests, meaning stolen tokens often bypass secondary verification. This technique serves the post-exploitation stage of an intrusion, where threat actors seek to expand their access. Teams usually rely on endpoint detection to catch such collection, but the variety of targeted applications complicates signature-based defenses. Check whether your security tools monitor for unusual file access patterns associated with known infostealer behaviors rather than just network traffic.

Background: Malware

Malware targets small businesses because they lack layered defenses. You must isolate sensitive data, restrict software execution, and verify IT provider backup integrity. Focus on reducing the attack surface through strict access controls and regular, offline data restoration tests.

Read the full guide: Malware Defense: Practical Steps for Small Business Security

What to do and how to stay safe: Aoki infostealer

• Review API usage logs for your AI coding tools to detect unauthorized consumption or quota depletion.
• Rotate OAuth tokens and API keys for all development assistants if you suspect endpoint compromise.
• Verify that your endpoint detection solutions are updated to identify recent Aoki infostealer variants.
• Audit permissions on connected repositories and cloud services to limit exposure from stolen credentials.

Step-by-step guide: Multi-Factor Authentication Setup for Small Teams

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this affect the AI providers' own security systems?

No, the findings concern credentials harvested from compromised user endpoints, not a breach of the AI providers themselves.

Which specific AI tools are targeted by the new Aoki variants?

Recent samples target Claude, ChatGPT, OpenAI Codex, Cursor, Codeium, and Gemini, alongside other development tools.

Has Symantec confirmed any downstream exploitation of the stolen data?

Researchers have not established downstream exploitation in this campaign, though they note the potential for unauthorized access.