LIVE FEED
HIGH AI-Powered Vishing Lets Fraudsters Bypass Help Desks // HIGH AI Agents Hijacked via Prompt Injection and Malicious Skills // HIGH Aokigahara Infostealer Targets Claude, Copilot, and Cursor Credentials // CRITICAL LiteLLM 1.107.0 Supply Chain Attack Steals AI Credentials // FIRST LOOK OpenAI Trains Frontier Models in Air-Gapped Offline Environments // HIGH Samsung TV Found Sending Audio to OpenAI Without Consent // CRITICAL LiteLLM PyPI Supply Chain Attack Drops Info-Stealer Malware // FIRST LOOK Walmart Opens Platform to AI Shopping Agents With Spend Controls // CRITICAL AI Agent ARTEX Weaponised in ConnectWise Supply Chain Breach // FIRST LOOK 1Password Launches Agent Login Tool That Shields Credentials //
ATLAS OWASP HIGH Significant risk · Prioritise patching LLM Security Industry News Research RELEVANCE ▲ 8.2

Aokigahara Infostealer Targets Claude, Copilot, and Cursor Credentials

SOURCE Check Point Research ↗
TL;DR HIGH
  • What happened: Aokigahara infostealer steals session tokens and credentials from AI coding and chat tools.
  • Who's at risk: Developers and power users of AI tools such as Claude, ChatGPT Desktop, Cursor, Copilot, and Gemini CLI are most exposed due to targeted collection routines for their credential and session files.
  • Act now: Rotate API keys and session tokens for all AI services and developer tools immediately if compromise is suspected · Enable MFA and monitor for anomalous login activity across AI platforms, cloud accounts, and code repositories · Audit local credential storage for AI tools and move secrets to dedicated secrets managers rather than plaintext config files
Aokigahara Infostealer Targets Claude, Copilot, and Cursor Credentials

Overview

Check Point Research has identified Aokigahara, a newly observed infostealer that extends traditional credential-theft tradecraft into AI application territory. Potentially related to earlier variants tracked as Kamidere or Stygian, Aokigahara includes dedicated collection routines for authentication files, session tokens, and configuration data associated with AI tools including Claude, ChatGPT Desktop, OpenAI Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI. This represents a meaningful evolution in infostealer targeting — attackers are now explicitly treating AI service access as a monetizable asset alongside banking credentials and cryptocurrency wallets.

Technical Analysis

Aokigahara is modular in design, organised around named handlers each responsible for a specific target category. Core capabilities include:

  • sysinfo handler: Enumerates system metadata including OS version, CPU/RAM, running processes, installed software, and detected antivirus products.
  • screenshot handler: Captures the active display state at time of execution.
  • Browser handler: Harvests passwords and cookies from Chromium-based browsers and Mozilla Firefox.
  • Crypto handler: Targets desktop wallet applications and browser-based wallet extensions.
  • AI tool handler: Collects authentication files, session tokens, and configuration files from Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI.
  • Developer environment handler: Grabs Git credential files, SSH private keys, and credential/configuration files for AWS, Azure, and Google Cloud.
  • Clipper component: Drops a secondary binary for clipboard manipulation, commonly used for cryptocurrency address substitution.

Additional targets span Discord, Telegram, Steam, Roblox, Minecraft, password managers, VPN clients, FTP/SFTP clients, and email applications.

The AI-specific collection routines are notable because many AI desktop clients and CLI tools store session tokens or API keys in predictable local file paths, often in plaintext or minimally protected formats. Exfiltrating these files grants attackers the ability to impersonate the victim against AI service APIs without needing to crack passwords.

Framework Mapping

  • AML.T0012 (Valid Accounts) and AML.T0113 (Steal Web Session Cookie): Aokigahara’s primary objective is acquiring usable credentials and session tokens to enable legitimate-appearing access to AI services.
  • AML.T0083 (Credentials from AI Agent Configuration) and AML.T0084 (Discover AI Agent Configuration): The malware specifically targets configuration files for AI coding assistants and CLI tools, a pattern that maps directly to these ATLAS techniques.
  • AML.T0040 (AI Model Inference API Access): Stolen API keys or session tokens could enable attackers to make inference requests under the victim’s identity and quota.
  • LLM06 (Sensitive Information Disclosure): Compromised AI sessions may expose private conversation history, code, and project context stored within AI platforms.

Impact Assessment

The primary risk groups are developers and technical professionals who use AI coding assistants and cloud-integrated toolchains daily. Stolen credentials could enable:

  1. Account resale — compromised AI subscriptions sold on underground forums.
  2. Quota abuse — unauthorized inference at the victim’s expense.
  3. Data exposure — access to private conversation histories and proprietary code.
  4. Lateral movement — SSH keys and cloud credentials enabling deeper infrastructure compromise.

Mitigation & Recommendations

  • Rotate credentials immediately for all AI services, cloud providers, and developer tools if endpoint compromise is suspected.
  • Enable MFA on all AI platform accounts and monitor for logins from unfamiliar IPs or devices.
  • Audit local credential storage: avoid plaintext API keys in config files; use OS-level credential stores or dedicated secrets managers (e.g., HashiCorp Vault, AWS Secrets Manager).
  • Deploy endpoint detection capable of identifying infostealer behavioural patterns such as mass file reads across credential directories.
  • Review SSH and cloud IAM keys for anomalous usage and rotate on a defined schedule.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.