Aokigahara Infostealer Targets Claude, Copilot, and Cursor Credentials
A newly identified infostealer dubbed Aokigahara has been observed actively harvesting authentication tokens and session data from AI development tools including Claude, ChatGPT Desktop, GitHub Copilot, Cursor, and Gemini CLI. Beyond traditional credential theft targeting browsers and crypto wallets, the malware includes dedicated collection routines for AI service credentials, SSH keys, and cloud environment configurations. Stolen AI session tokens could enable unauthorized access to paid AI services, exposure of private development data, or resale of compromised accounts on underground markets.