Published on October 26, 2026
Aokigahara Infostealer Targets AI Coding Tools to Steal Developer Credentials
Severity
Medium
A newly observed information-stealing malware known as Aokigahara is expanding credential theft beyond web browsers and cryptocurrency wallets by targeting AI coding assistants, developer tools, and cloud environments. The malware searches local application files for authentication tokens, session data, configuration files, and other information that could provide access to developers’ accounts and resources.
The targeted applications include Claude Code and Desktop, ChatGPT Desktop, OpenAI Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant. The malware also collects information associated with AWS services and other development environments, potentially exposing source-code repositories, cloud resources, and connected services.
The malware does not exploit a specific vulnerability in these AI applications. Instead, it takes advantage of sensitive information stored locally on developer workstations, where authentication data and configuration files may be accessible to malware running under the compromised user’s account.
How?
Aokigahara contains dedicated collection routines for different applications and development environments. Its AI-session collection module searches for authentication and configuration data associated with coding assistants, including Codex authentication files, Claude credentials, Cursor and Windsurf state databases, and GitHub Copilot storage. It also targets Amazon Q, Kiro, AWS credentials, and AWS single sign-on caches.
The malware extends its collection beyond AI applications by searching development environments such as Visual Studio Code, Cursor, Windsurf, and JetBrains products. It looks for Git credentials, files within .ssh directories that may contain private keys, and configuration files associated with AWS, Azure, and Google Cloud. Matching information is collected and prepared for exfiltration.
Stolen authentication material could allow attackers to access developer accounts, repositories, cloud environments, or connected development services, depending on the validity and permissions of the exposed credentials. AI application data may also contain private conversations, project details, development information, and other sensitive context.
Aokigahara retains traditional infostealer capabilities, including browser password and cookie theft, screenshot capture, clipboard collection, cryptocurrency wallet theft, and data collection from messaging, email, VPN, FTP, and password-management applications.
The malware stores its encrypted configuration in a .stgcfg section and decrypts it using AES-256-CBC. The configuration contains information such as command-and-control (C2) infrastructure, encryption-related parameters, enabled collection modules, certificate-pinning settings, and fallback URLs.
For data exfiltration, Aokigahara uses a multi-stage upload process involving /gate/handshake, /gate/chunk, and /gate/complete. It uses an X25519 key exchange to establish shared key material, with SHA-256 deriving the encryption key used to protect collected ZIP archives through AES-256-GCM. Upload headers identify the collection module and chunk sequence.
The malware also includes anti-analysis checks that inspect debugger indicators, virtualization artifacts, hardware resources, running processes, cursor movement, and suspicious account names. Configurable language checks can terminate execution under selected conditions, making analysis more difficult.
The findings indicate that Aokigahara’s operators are expanding their collection capabilities to include AI-assisted development environments, where locally stored authentication data and project information may provide access beyond a single compromised endpoint.
Conclusion
The expansion of infostealer capabilities into AI coding assistants introduces additional risks for developer workstations. Compromised authentication tokens, cloud credentials, SSH keys, and development configuration files could expose source-code repositories, cloud infrastructure, and connected services.
Aokigahara demonstrates that AI tools do not need to contain a vulnerability to become targets. When sensitive authentication data and development information are stored locally, an existing endpoint compromise can potentially extend into the wider development and cloud environment.
Source