Aoki Malware Expands Targets to AI Tool Credentials, Raising Risks for Developers A new variant of the Aoki (Aokigahara) malware, an information stealer, has broadened its scope to target credentials and session data from popular AI tools, including ChatGPT, Claude, OpenAI Codex, Cursor, Codeium, and Google Gemini. Researchers from Symantec’s Threat Hunter team identified the updated malware, which now searches for local files such as `.claude.json`, Claude desktop cookies, ChatGPT cookies, and configuration files like `Codex config.toml` and `.env`. Unlike vulnerabilities in AI services themselves, Aoki focuses on locally stored data on infected devices. Stolen tokens or keys could allow attackers to impersonate users, incur paid usage charges, or access connected services, including cloud accounts, repositories, and CI/CD pipelines. Earlier versions of Aoki did not target AI-related files, indicating this is a recent evolution in its data-collection tactics. Beyond AI tools, Aoki continues to harvest a wide range of sensitive data, including: - Browser data: Cookies, saved passwords, autofill details, credit card information, and Google tokens. - Cryptocurrency wallets: Files and extensions from popular wallets. - Messaging apps: Telegram and Discord session data. - Security tools: Records of installed security products. - Other applications: VPNs, password managers, gaming services, and file-transfer tools. The malware exfiltrates stolen data to a command-and-control (C2) server via a `/gate` endpoint, with newer samples using multiple domains (e.g., `dobeqnesmot[.]cc`, `hjazfioe[.]surf`) instead of older IP-based connections over unencrypted HTTP. Symantec classifies the threat as Infostealer.Aoki, though its origins remain unlinked to a known threat group. The shift toward AI credentials aligns with a broader trend of LLMjacking, where attackers abuse stolen accounts to run paid AI models at the victim’s expense. While Aoki’s primary focus is local data theft, compromised AI tokens could expose developers to secondary risks, including unauthorized access to source code repositories and cloud services. Symantec’s report includes indicators of compromise (IoCs), such as file hashes and C2 domains, to aid detection efforts. The malware’s expanded targeting underscores the need for developers to treat local AI configuration files and session data as sensitive assets, similar to cloud keys and source-control credentials.