Symantec's Threat Hunter Team says the Aoki (aka Aokigahara) infostealer, a relatively new stealer first seen earlier in 2026, has begun stealing credentials for AI coding assistants, and that older samples did not look for AI-related files, so the capability was added recently.

Symantec says the newest version it found targeted .claude.json, Claude desktop cookies, ChatGPT cookies and the Codex config.toml and .env files, and stole tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, along with Amazon Web Services (AWS) credentials. It also steals data from dozens of browsers, cryptocurrency wallet extensions and desktop wallets, password managers (including Bitwarden, 1Password, Dashlane and KeePass config), Discord and Telegram clients, gaming platforms, Outlook and Thunderbird, FTP clients and VPN clients, and records which security products are installed, according to Symantec.

Symantec says the malware has no backdoor command list: it collects whatever data is available and sends it to its command-and-control server through a /gate endpoint.

Symantec says it stole credential, token and session files rather than source code, with the exception of Cursor's local state database, which can cache chat context and code snippets.

Symantec says stolen API keys and OAuth or session tokens let attackers act under a legitimate developer's identity and API quota and can expose connected repositories, cloud services and CI/CD pipelines.

Symantec says it does not know what group is behind the malware and there are no indications it is linked to any existing malware family.