Aokigahara Infostealer Targets AI Tools and Developer Credentials
Check Point Research has identified Aokigahara, a newly observed infostealer spotted in the wild that targets AI applications and development tools alongside traditional browser credentials, cryptocurrency wallets, and session cookies. An earlier version may have been known as Kamidere or Stygian, according to the researchers.
Quick Take
- What: Aokigahara infostealer collects authentication files, session data, and configuration files from AI tools including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI.
- Who is affected: Users of AI development tools, cloud services (AWS, Azure, Google Cloud), and traditional targets including browser users, cryptocurrency wallet holders, and VPN clients.
- Developer credentials: The malware steals Git credential files, SSH private keys, AWS/Azure/Google Cloud credential and configuration files, and GitHub Copilot storage.
- Monetization risk: Stolen AI credentials could enable unauthorized access to paid AI services or resale of compromised accounts, though researchers have not confirmed how operators monetize the data.
- What to do: Monitor for unauthorized access to AI services and cloud accounts, rotate credentials if compromise is suspected, and deploy endpoint protection that detects infostealer behavior.
In plain English
A new data-stealing program called Aokigahara has been found stealing login information from AI chatbots and coding assistants like ChatGPT, Claude, and GitHub Copilot, in addition to the usual targets like browser passwords and cryptocurrency wallets. If attackers get your AI tool credentials, they could use your paid subscriptions without permission or sell access to your accounts. The malware also steals developer credentials that could let attackers into cloud services and code repositories.
What you should do: If you use AI coding tools or cloud services, watch for suspicious logins and change your passwords if you notice anything unusual. Regular users who don’t use these developer tools can ignore this threat.
What happened
Check Point Research discovered Aokigahara, a newly observed infostealer active in the wild. The malware includes an aisessions handler that specifically targets AI applications and development tools. According to the research, targeted AI tools include Claude Code and Desktop, Codex, ChatGPT Desktop, Cursor, Windsurf, Kiro, GitHub Copilot and VS Code, Gemini CLI, and JetBrains AI Assistant. The handler also queries Windows Credential Manager.
The malware collects authentication files, session data, and configuration files associated with these AI services. Check Point notes that valid credentials or session tokens could expose private conversations and development data, enable unauthorized use of paid services, or potentially be sold to provide access to compromised AI accounts.
Beyond AI tools, Aokigahara includes an ide handler that collects local data from code editors including VS Code, Cursor, Windsurf, and JetBrains products. Notable targets include Git credential files, files under .ssh that may contain private keys, and AWS, Azure, and Google Cloud credential and configuration files. The researchers state that if usable secrets are exposed, attackers could gain access to source code repositories, cloud resources, and other development services.
The malware also includes traditional infostealer capabilities targeting Chromium-based browsers and Mozilla Firefox, desktop cryptocurrency wallets and browser wallet extensions, messaging applications such as Discord and Telegram, gaming platforms including Steam, Roblox, and Minecraft, password managers, VPN clients, FTP/SFTP clients, and email applications. It captures screenshots, clipboard contents, and system information including computer and user names, IP address, Windows version, CPU and RAM details, running processes, and installed software.
Aokigahara includes a clipper handler that drops a separate component for clipboard manipulation, though the targeted cryptocurrency wallet address formats have not been confirmed by the researchers.
What it means
The emergence of Aokigahara represents an expansion in infostealer targeting beyond traditional financial and personal data. Check Point Research notes that this expanded targeting “reflects a broader shift in what attackers may consider valuable, not only personal accounts and financial data, but also access to AI services and the environments developers use to build software.”
The researchers observe that stolen AI credentials could offer opportunities for monetization through unauthorized access to paid AI services or the resale of compromised accounts. However, Check Point explicitly states that while the malware’s collection routines support these possibilities, the analysis does not confirm how its operators monetize the stolen data.
For developers, the theft of cloud credentials and SSH private keys poses significant risk. The malware’s ability to collect AWS, Azure, and Google Cloud credential files, combined with Git credentials and SSH keys, could provide attackers with access to source code repositories, cloud infrastructure, and development environments.
The malware targets a wide range of AI and development tools that have become common in software development workflows. The inclusion of tools like Cursor, Windsurf, and GitHub Copilot alongside traditional targets suggests that attackers are adapting their collection strategies to match the evolving technology landscape.
