‘Aokigahara’ Stealer Targets ‘Developer Keyrings’ & AI Assistants

The malware’s focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.

A novel infostealer that specifically targets AI applications and development tools is changing the narrative on illicit data monetization, opening up fresh revenue streams through extortion and other abuses of the stolen data.

Researchers from Check Point Software discovered the malware, dubbed Aokigahara after the Japanese “haunted forest” at the base of Mount Fuji, which does typical stealer things, they said in a recent report. It targets Windows-based machines and the browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications running on them — among other apps and services — with data theft.

However, Aokigahara is notable in that it has a particular focus on emerging AI-driven assets, collecting authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools, according to Check Point. This sets it apart from many of the infostealers currently active in the wild.

“This expanded targeting reflects a broader shift in what attackers may consider valuable, not only personal accounts and financial data but also access to AI services and the environments developers use to build software,” according to Check Point.

Different Targets for Cybercrime, Different Financial Opportunities

The AI data offers unique opportunities for threat actors to benefit financially from the stealer’s activities by using credentials or session tokens to “enable unauthorized access to paid AI services or the resale of compromised accounts,” according to the report.

The malicious activity can also extend to developer and cloud environments, and thus threaten enterprises. Indeed, threat actors have already demonstrated how they use stolen credentials for GitHub accounts, SSH private keys, and AWS, Azure, and Google Cloud credential and configuration files to infiltrate cloud environments of enterprise targets.

This may also pave the way for extortion of organizations by holding stolen data for ransom, according to Check Point.

“Users can share sensitive business information, proprietary source code, and other confidential material with AI services,” according to the post. “If stolen credentials or session tokens provide access to conversation histories or uploaded files, attackers could potentially threaten to disclose that information to demand payment.”

Denis Calderone, chief technology officer of security firm Suzu Labs, tells Dark Reading that “stolen AI credentials can yield a heavy harvest for an attacker. A paid AI subscription is a resellable asset, and the conversation history behind it is often full of proprietary code, which means these stolen sessions now carry extortion value alongside their resale value.”

Aokigahara Infostealer Malware In Action

Once an Aokigahara infection begins, it scans a computer for sensitive data, including browser passwords, session cookies, cryptocurrency wallets, and credentials stored by AI assistants such as ChatGPT, Claude, Cursor, and GitHub Copilot. It also searches local application files for authentication tokens, API keys, and other potentially valuable information.

Other targeted data the malware looks for are developer and cloud credentials, including Git access data, SSH keys, and configuration files for AWS, Azure, and Google Cloud. This data is valuable to give attackers access to private code repositories or cloud resources if the stolen credentials remain valid and have sufficient permissions, according to Check Point.

Indeed, “a developer’s AI assistant is a keyring,” Calderone observes, and some of those keys ultimately could give attackers access to the kingdom.

“The same malware that lifts the Cursor or Copilot session is also grabbing Git credentials, SSH private keys, and AWS config files off that workstation, so one infected machine can expose the codebase, the repos, and the cloud in a single run,” he says.

Aokigahara also has built-in anti-detection mechanisms. It checks for analysis environments such as virtual machines and sandboxes, and packages stolen data into zip archives and then encrypts it before sending it to attacker-controlled servers.

Modern Defense as Attackers Expand Objectives

Aokigahara’s targeting of AI tools expands the traditional infostealer playbook, potentially exposing AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint. The theft of this data then opens new pathways for financial gain for attackers and thus may provide an incentive for others to do the same, according to Check Point.

This means that defenders should start treating AI-tool authentication data as enterprise secrets, with protections comparable to those applied to cloud credentials and developer keys. To that end, security teams should hunt for AI-session theft by investigating suspicious access to local application storage and authentication-related files belonging to AI assistants, coding agents, and developer IDEs.

Organizations also should more closely protect developer and cloud credentials by reducing the persistence of long-lived secrets on endpoints, using managed identity and short-lived credentials where feasible, and restricting access to cloud resources and source-code repositories.

Further, organizations can protect assets across exposed apps and tools by revoking exposed sessions and rotating secrets. If an endpoint is suspected of compromise, according to Check Point, they should assess AI sessions, API keys, GitHub credentials, SSH keys, and cloud tokens, not just browser passwords.