AI Security

Aoki infostealer now raids Claude, Copilot and Cursor credentials

Symantec says the Aoki infostealer now steals tokens and keys for Claude, Codex, Cursor, Copilot and Gemini. What UK development teams should do now.

Illustration of an AI chip with a warning symbol representing malware stealing AI coding assistant credentials

A little-known infostealer called Aoki has learned to lift the tokens, keys and session files that AI coding assistants leave on developer machines. For UK software teams, a single infected laptop could now hand attackers their AI accounts, their cloud estate and a route into the build pipeline.

What happened

On 15 October 2026 Symantec’s Threat Hunter Team, part of Broadcom, published analysis of Aoki, an information-stealing malware family that also goes by the name Aokigahara. Aoki first surfaced earlier this year and has had very little public scrutiny. Earlier samples behaved like a typical commodity stealer, harvesting browser data, cryptocurrency wallets and password manager contents. The newest builds add something different: a dedicated collection routine for the credentials and session material used by AI coding assistants.

The list of targeted tools reads like the standard kit of a modern development team. Symantec names Anthropic’s Claude, OpenAI’s Codex and ChatGPT, Cursor, Codeium, Google Gemini, GitHub Copilot, JetBrains AI Assistant and Kiro, together with Amazon Web Services credentials.

Symantec says it does not know who operates Aoki and has found no links to an established malware family. The heavy focus on cryptocurrency suggests the operators are after money rather than intelligence. The researchers also describe the code as still under active development, so the target list is likely to keep growing.

The technical picture

Aoki does not exploit a flaw in any of these AI products. It simply knows where they keep their secrets. According to Symantec, it collects the .claude.json file and the Claude desktop cookie store, ChatGPT cookies, and the config.toml and .env files used by Codex. From Cursor it takes tokens and the local state database, which can cache chat context and fragments of code. The emphasis is on credential, token and session files rather than bulk theft of source code.

Beyond the AI tooling, Aoki has the full stealer repertoire: browser cookies, autofill and card details, crypto wallets, Discord and Telegram data, email clients, VPN and FTP clients, and password managers. There is no remote command set. It grabs everything it can find and posts it to a command-and-control server over HTTPS, using a /gate endpoint on one of three domains Symantec has published. Older samples talked to a bare IP address over unencrypted HTTP on port 8080. Symantec lists 17 file hashes and detects the family as Infostealer.Aoki. The report does not say how Aoki reaches victims.

Why do criminals want these files? Symantec’s view is that AI credentials now sit alongside payment cards and crypto wallets as a tradable commodity. A stolen key or session token lets an attacker operate under a genuine developer’s identity and spending quota, slipping past controls that assume the user is trusted. The keys can be resold or burned on the attacker’s own workloads, the practice usually called LLMjacking. Wiz research cited by The Hacker News adds that provider keys may also open historical chat logs containing sensitive corporate material.

Aoki is not an isolated case. In September, Gen Digital reported stealers such as Amatera, Remus and CallbackBeaver adding paths for Claude, Cursor and other agents, and noted that MCP configuration files can hold API keys for source control, databases and cloud services.

Flow diagram showing Aoki infecting a developer machine, harvesting AI assistant tokens, exfiltrating them and using them to reach repositories and cloud services

Why it matters for UK organisations

AI coding assistants have spread through UK development teams far faster than the controls around them. Often they arrived bottom-up, installed and connected to GitHub and a cloud console by developers themselves. The result is a cluster of long-lived, highly privileged credentials sitting in plain files in a user’s home directory, often on a machine that also runs browsers, chat apps and the occasional unofficial tool.

That is exactly what a stealer like Aoki is built to harvest. The direct cost of LLMjacking is a surprise bill. The larger risk is what the tokens connect to. An assistant that can read repositories, open pull requests or call cloud APIs on a developer’s behalf gives an attacker the same reach. For a software supplier, that turns one infected endpoint into a potential supply chain incident for every customer downstream, at a time when UK regulators and customers are paying far closer attention to supplier security.

There is also a data protection angle. If chat histories or cached context include customer data, internal hostnames or credentials, their theft may be a personal data breach in its own right, with the usual 72-hour clock for reporting to the ICO.

Expert view

None of this is technically novel. Stealers have been lifting browser cookies and cloud keys for years, and session replay has been the quiet way round MFA for almost as long. What has changed is the concentration of privilege. When we test development environments, the developer workstation is already the softest route to production, and AI agents have made it softer. A single .env file can hold model provider keys, cloud credentials and tokens for the tools the agent is wired into.

In my experience, most organisations cannot answer a basic question: which AI assistants are installed across our estate, and what are they authorised to touch? Until that inventory exists, detection and revocation are guesswork. It is also worth being clear that MFA will not save you here. A copied session or refresh token is already past the login prompt.

The good news is that the fixes are ordinary hygiene, applied to a new class of credential.

What to do now

  1. Hunt for Aoki. Load Symantec’s published hashes and command-and-control domains into your EDR, proxy and DNS controls, and look for outbound HTTPS requests to /gate paths from developer machines. This maps to the Cyber Essentials malware protection control.
  2. Inventory AI assistants. Establish which coding assistants and agents are installed, which accounts they use and what repositories, cloud roles and MCP servers they can reach. Bring unmanaged installs under policy (secure configuration).
  3. Shrink token lifetimes and scope. Prefer short-lived, least-privilege tokens for assistants and the tools they connect to, and avoid giving agents standing write access to production or broad cloud roles (user access control).
  4. Move secrets out of plain files. Keep keys out of .env files, prompts and chat histories where you can, using a secrets manager or the platform credential store instead.
  5. Prepare a rotation playbook. If a developer device is infected, work from a clean machine to revoke AI sessions, rotate provider keys, cloud credentials and Git tokens, review usage and billing for anomalies, and check what cached conversations may have exposed. Consider whether an ICO notification is needed.
  6. Close the usual delivery routes. Patch browsers and tools, block cracked software and unofficial installers, and train developers on fake CAPTCHA and copy-and-paste command lures (security update management).
  7. Watch provider dashboards. Set spending alerts on every AI provider account so LLMjacking shows up quickly.

Bottom line

Aoki is a modest piece of malware with a pointed shopping list. By adding AI coding assistants to its targets, it confirms that criminals now see developer AI credentials as a prize worth stealing. UK teams that have adopted these tools quickly should treat the tokens they generate with the same care as cloud admin keys, because in practice that is often what they are.

Sources

Related Posts